We're building a production certificate automation tool using Google Trust Services' production ACME API (dv.acme-v02.api.pki.goog).
We've observed that when we place a new order and fetch the raw authorization object, the "expires" field is consistently exactly 8 days after the order's creation timestamp — reproduced across 2 different domains and 2 different ACME accounts.
Within this 8-day window, a new order for the same domain/account automatically reuses the existing authorization as "valid" — no DNS-01 challenge needed. After 8 days, a new order requires a fresh DNS-01 challenge.
GTS's CP/CPS (Section 4.2.1) states validation data may be reused for up to 200 days — but we observe a hard boundary at 8 days.
Questions:
1. Is this 8-day authorization validity an intentional, fixed, documented policy, separate from the 200-day CP/CPS ceiling?
2. Is this duration stable, or could it change without notice?
3. Does this differ for wildcard domain authorizations?
A clear, authoritative answer would help us build reliable production automation. Thank you
