acme-server: orders + authorizations + finalize + cert download (Phase 2/7)

Closes the issuance loop in trust_authenticated mode (commits ec88a61
+ 44a85d6 wired the foundation + JWS-verified account resource).
After this commit, an ACME client running against a profile with
acme_auth_mode='trust_authenticated' end-to-end-issues a real cert:

  POST /acme/profile/<id>/new-order      → 201 + order URL (status=ready)
  POST /acme/profile/<id>/order/<oid>    → POST-as-GET fetch
  POST /acme/profile/<id>/order/<oid>/finalize  → 200 + status=valid + cert URL
  POST /acme/profile/<id>/cert/<cid>     → 200 + PEM chain

Profiles with acme_auth_mode='challenge' get the same code path with
authz/challenge rows in `pending` state until Phase 3's validators
wire up. The mode is read from the bound profile's column at request
time, NOT cached at server start — operators flipping the column via
SQL take effect on the next order without restart.

Architecture (the load-bearing part):
  - Finalize routes through service.CertificateService.Create — the
    canonical certctl issuance entry point that wraps the
    managed_certificates row insert + audit row in s.tx.WithinTx.
    RenewalPolicy / CertificateProfile / per-issuer-type Prometheus
    metrics / audit rows all apply uniformly to ACME-issued certs via
    the same code path that already serves EST/SCEP/agent/REST issuance.
  - Identifier validation runs BEFORE order creation. Rejected
    identifiers return RFC 7807 with per-identifier subproblems and
    create no order row.
  - Source stamp on managed_certificates: domain.CertificateSourceACME.
    Operators bulk-revoke ACME-issued certs by filtering on Source=ACME.
  - 3-step atomicity boundary documented in code + this commit msg:
    (A) WithinTx-A marks order processing + audit row.
    (B) IssuerConnector.IssueCertificate + CertificateService.Create
        (each in its own WithinTx — Create wraps cert row + audit
        atomically).
    (C) WithinTx-C creates certificate_versions row + transitions order
        to valid + sets certificate_id + audit row.
    The brief window between B and C can leave a managed_certificates
    row whose order is still in `processing`. Phase 5's GC scheduler
    reconciles. Documented inline.

What ships:
  - internal/api/acme/order.go: OrderResponseJSON + AuthorizationResponseJSON
    + ChallengeResponseJSON + NewOrderRequest + FinalizeRequest wire
    shapes; ValidateIdentifiers (Phase 2 syntactic checks, dns-only);
    CSRMatchesIdentifiers (RFC 8555 §7.4 strict equality, case-folded).
  - internal/domain/acme.go: ACMEOrder + ACMEAuthorization + ACMEChallenge
    + ACMEIdentifier + ACMEProblem domain types + closed status enums
    for each (order: pending|ready|processing|valid|invalid; authz:
    pending|valid|invalid|deactivated|expired|revoked; challenge:
    pending|processing|valid|invalid; challenge type: http-01|dns-01|
    tls-alpn-01).
  - internal/domain/profile.go: new ACMEAuthMode field reading from
    certificate_profiles.acme_auth_mode (added in migration 25).
  - internal/domain/certificate.go: new CertificateSourceACME enum value.
  - internal/repository/postgres/profile.go: extended SELECT/scanProfile
    to read the per-profile acme_auth_mode column with a COALESCE
    default of trust_authenticated.
  - internal/repository/postgres/acme.go: full order/authz/challenge
    CRUD (CreateOrderWithTx + GetOrderByID + UpdateOrderWithTx +
    CreateAuthzWithTx + GetAuthzByID + ListAuthzsByOrder +
    ListChallengesByAuthz + CreateChallengeWithTx) with proper
    sql.NullTime + JSONB handling. scanACMEOrder /
    scanACMEAuthz / scanACMEChallenge helpers.
  - internal/service/acme.go: extended ACMERepo interface; new
    SetIssuancePipeline wires certificateService + certificateRepo +
    issuerRegistry. CreateOrder (auth-mode-dispatched: trust_authenticated
    auto-marks order ready + authz valid + 1 placeholder http-01
    challenge valid; challenge mode keeps everything pending). LookupOrder
    (with account-ownership assertion). LookupAuthz. ListAuthzsByOrder.
    FinalizeOrder (3-step atomicity boundary as above; CSR-vs-order
    SAN strict-equality check before issuance; persists FinalizeOrderResult
    {Order, CertID}). LookupCertificate. randIDSuffix + base32encode
    helpers for the human-readable acme-ord-* / acme-authz-* /
    acme-chall-* prefixes (CLAUDE.md "TEXT primary keys with human-
    readable prefixes" architecture decision). 8 new per-op metrics.
  - internal/service/acme_test.go: extended fakeACMERepo with Phase 2
    interface stubs; new orderTrackingRepo for observable persistence;
    2 new tests asserting trust_authenticated → auto-ready/valid and
    challenge → stays-pending.
  - internal/api/handler/acme.go: NewOrder + Order + OrderFinalize +
    Authz + Cert handler methods. orderURL / authzURL / certURL /
    challengeURLBuilder helpers; marshalOrderForResponse fetches
    per-order authzs to populate the URL list. parseOptionalTime for
    notBefore / notAfter.
  - internal/api/handler/acme_handler_test.go: extended mockACMEService
    with Phase 2 method stubs; 4 new handler tests (NewOrder happy +
    rejected-identifier + OrderFinalize bad-CSR + Cert happy).
  - internal/api/router/router.go: 10 new Register calls (5 per-profile
    + 5 shorthand) for new-order, order/{ord_id}, order/{ord_id}/finalize,
    authz/{authz_id}, cert/{cert_id}.
  - internal/api/router/openapi_parity_test.go + api/openapi-handler-exceptions.yaml:
    10 new exception entries.
  - cmd/server/main.go: SetIssuancePipeline at startup, threading
    certificateService + certificateRepo + issuerRegistry into ACMEService.
  - docs/acme-server.md: phase status updated; endpoints table grows
    5 rows for new-order/order/finalize/authz/cert (per-profile +
    shorthand variants); new section "Finalize routing through
    CertificateService.Create" documenting the 3-step atomicity
    boundary + the actor-string convention `acme:<account-id>`.

Tests: ACME package + service + handler + router + config + domain
all green under -short. New cases:
  - TestCreateOrder_TrustAuthenticated_AutoReady (asserts auto-ready
    transition + valid-status authz/challenge + audit row + metric bump).
  - TestCreateOrder_ChallengeMode_StaysPending (asserts pending-status
    cascading authz/challenge for challenge mode).
  - TestACMEHandler_NewOrder_HappyPath (asserts 201 + Location +
    finalize URL shape).
  - TestACMEHandler_NewOrder_RejectedIdentifier (asserts 400 + RFC 7807
    rejectedIdentifier + per-identifier subproblems for type=ip).
  - TestACMEHandler_OrderFinalize_BadCSR (asserts 400 + badCSR for
    non-base64 CSR field).
  - TestACMEHandler_Cert_HappyPath (asserts 200 + PEM content-type +
    PEM chain in body).

Engineering history: cowork/WORKSPACE-CHANGELOG.md "ACME-Server-2".

internal/service/acme.go

@@ -5,8 +5,11 @@ package service
 
 import (
 	"context"
+	cryptorand "crypto/rand"
+	"crypto/x509"
 	"errors"
 	"fmt"
+	"strings"
 	"sync/atomic"
 	"time"
 
@@ -38,6 +41,14 @@ type ACMERepo interface {
 	GetAccountByThumbprint(ctx context.Context, profileID, thumbprint string) (*domain.ACMEAccount, error)
 	UpdateAccountContactWithTx(ctx context.Context, q repository.Querier, accountID string, contact []string) error
 	UpdateAccountStatusWithTx(ctx context.Context, q repository.Querier, accountID string, status domain.ACMEAccountStatus) error
+	// Phase 2 — order / authz / challenge CRUD.
+	CreateOrderWithTx(ctx context.Context, q repository.Querier, order *domain.ACMEOrder) error
+	GetOrderByID(ctx context.Context, orderID string) (*domain.ACMEOrder, error)
+	UpdateOrderWithTx(ctx context.Context, q repository.Querier, order *domain.ACMEOrder) error
+	CreateAuthzWithTx(ctx context.Context, q repository.Querier, authz *domain.ACMEAuthorization) error
+	GetAuthzByID(ctx context.Context, authzID string) (*domain.ACMEAuthorization, error)
+	ListAuthzsByOrder(ctx context.Context, orderID string) ([]*domain.ACMEAuthorization, error)
+	CreateChallengeWithTx(ctx context.Context, q repository.Querier, ch *domain.ACMEChallenge) error
 }
 
 // profileLookup is the minimum surface ACMEService needs to resolve a
@@ -51,10 +62,12 @@ type profileLookup interface {
 // ACMEService orchestrates the ACME server's RFC 8555 surface.
 //
 //   - Phase 1a (live): BuildDirectory, IssueNonce.
-//   - Phase 1b (this commit): VerifyJWS, NewAccount, LookupAccount,
+//   - Phase 1b (live): VerifyJWS, NewAccount, LookupAccount,
 //     UpdateAccount, DeactivateAccount.
-//   - Subsequent phases extend with new-order, finalize, challenges,
-//     key-change, revoke, ARI.
+//   - Phase 2 (this commit): CreateOrder, LookupOrder, FinalizeOrder,
+//     LookupAuthz, LookupCertificate.
+//   - Subsequent phases extend with challenge validation, key
+//     rollover, revocation, ARI.
 //
 // The struct deliberately holds raw config rather than per-field
 // extracted values — readers use 4 of the 11 fields and reading them
@@ -74,6 +87,17 @@ type ACMEService struct {
 	// stateful tables.
 	tx           repository.Transactor
 	auditService *AuditService
+
+	// Phase 2 — finalize plumbing. The finalize handler routes
+	// through CertificateService.Create (managed_certificates row +
+	// audit row in its own WithinTx) AND certRepo.CreateVersionWithTx
+	// (certificate_versions row). Issuance itself goes through the
+	// IssuerRegistry's IssuerConnector adapter — same code path
+	// EST/SCEP/agent take. cmd/server/main.go wires all three at
+	// startup; tests inject mocks.
+	certService    *CertificateService
+	certRepo       repository.CertificateRepository
+	issuerRegistry *IssuerRegistry
 }
 
 // NewACMEService constructs an ACMEService with the directory + nonce
@@ -99,6 +123,21 @@ func (s *ACMEService) SetTransactor(tx repository.Transactor) { s.tx = tx }
 // every service that emits audit rows.
 func (s *ACMEService) SetAuditService(a *AuditService) { s.auditService = a }
 
+// SetIssuancePipeline wires Phase 2 finalize dependencies: the
+// certificate service (for managed_certificates row + audit row),
+// the certificate repository (for certificate_versions row), and the
+// issuer registry (for routing IssueCertificate against the bound
+// profile's issuer). cmd/server/main.go calls this at startup.
+//
+// All three are required for the finalize path. When unset, FinalizeOrder
+// returns ErrACMEFinalizeUnconfigured (handler maps to
+// urn:ietf:params:acme:error:serverInternal).
+func (s *ACMEService) SetIssuancePipeline(certSvc *CertificateService, certRepo repository.CertificateRepository, registry *IssuerRegistry) {
+	s.certService = certSvc
+	s.certRepo = certRepo
+	s.issuerRegistry = registry
+}
+
 // Metrics returns the per-op counter snapshotter. cmd/server/main.go
 // passes this into MetricsHandler so the Prometheus exposer picks up
 // the per-op signals.
@@ -127,6 +166,41 @@ var ErrACMEAccountNotFound = errors.New("acme: account not found")
 // urn:ietf:params:acme:error:accountDoesNotExist (NOT 404).
 var ErrACMEAccountDoesNotExist = errors.New("acme: account does not exist for this JWK")
 
+// Phase 2 sentinels.
+
+// ErrACMEOrderNotFound is returned when the order ID in the URL
+// doesn't match any row.
+var ErrACMEOrderNotFound = errors.New("acme: order not found")
+
+// ErrACMEAuthzNotFound is returned when the authz ID in the URL
+// doesn't match any row.
+var ErrACMEAuthzNotFound = errors.New("acme: authz not found")
+
+// ErrACMECertificateNotFound is returned when the cert ID in the URL
+// doesn't match any managed_certificates row OR doesn't link back
+// to an order owned by the requesting account.
+var ErrACMECertificateNotFound = errors.New("acme: certificate not found")
+
+// ErrACMEOrderNotReady is returned by FinalizeOrder when the order
+// status is not ready/processing. RFC 8555 §7.4 mandates
+// urn:ietf:params:acme:error:orderNotReady.
+var ErrACMEOrderNotReady = errors.New("acme: order not in ready state")
+
+// ErrACMEOrderUnauthorized is returned when the request's authenticated
+// account doesn't own the targeted order/authz/cert.
+var ErrACMEOrderUnauthorized = errors.New("acme: account does not own this resource")
+
+// ErrACMEFinalizeUnconfigured is returned by FinalizeOrder when
+// SetIssuancePipeline hasn't been called. Indicates a deploy-time
+// wiring bug; mapped to serverInternal.
+var ErrACMEFinalizeUnconfigured = errors.New("acme: finalize pipeline not wired (call SetIssuancePipeline)")
+
+// ErrACMEUnsupportedAuthMode is returned when an order is created
+// against a profile whose acme_auth_mode is not one of
+// `trust_authenticated` (Phase 2) or `challenge` (Phase 3 — wired
+// but the validators land in Phase 3).
+var ErrACMEUnsupportedAuthMode = errors.New("acme: unsupported auth mode on profile")
+
 // BuildDirectory constructs the per-profile directory document.
 //
 // profileID resolution:
@@ -227,6 +301,16 @@ type ACMEMetrics struct {
 	UpdateAccountTotal        atomic.Uint64
 	UpdateAccountFailureTotal atomic.Uint64
 	DeactivateAccountTotal    atomic.Uint64
+
+	// Phase 2 — orders + finalize + cert download.
+	NewOrderTotal             atomic.Uint64
+	NewOrderFailureTotal      atomic.Uint64
+	NewOrderRejectedTotal     atomic.Uint64 // identifier-validation rejection
+	FinalizeOrderTotal        atomic.Uint64
+	FinalizeOrderFailureTotal atomic.Uint64
+	CertDownloadTotal         atomic.Uint64
+	CertDownloadFailureTotal  atomic.Uint64
+	AuthzReadTotal            atomic.Uint64
 }
 
 // NewACMEMetrics returns a zeroed counter table. Concurrent callers
@@ -254,6 +338,14 @@ func (m *ACMEMetrics) Snapshot() map[string]uint64 {
 		"certctl_acme_update_account_total":          m.UpdateAccountTotal.Load(),
 		"certctl_acme_update_account_failures_total": m.UpdateAccountFailureTotal.Load(),
 		"certctl_acme_deactivate_account_total":      m.DeactivateAccountTotal.Load(),
+		"certctl_acme_new_order_total":               m.NewOrderTotal.Load(),
+		"certctl_acme_new_order_failures_total":      m.NewOrderFailureTotal.Load(),
+		"certctl_acme_new_order_rejected_total":      m.NewOrderRejectedTotal.Load(),
+		"certctl_acme_finalize_order_total":          m.FinalizeOrderTotal.Load(),
+		"certctl_acme_finalize_order_failures_total": m.FinalizeOrderFailureTotal.Load(),
+		"certctl_acme_cert_download_total":           m.CertDownloadTotal.Load(),
+		"certctl_acme_cert_download_failures_total":  m.CertDownloadFailureTotal.Load(),
+		"certctl_acme_authz_read_total":              m.AuthzReadTotal.Load(),
 	}
 }
 
@@ -504,3 +596,491 @@ func (s *ACMEService) DeactivateAccount(ctx context.Context, accountID string) (
 	s.metrics.bump(&s.metrics.DeactivateAccountTotal)
 	return acct, nil
 }
+
+// --- Phase 2 — orders + authz + finalize + cert download ---------------
+
+// CreateOrder validates a new-order request against the bound profile
+// and persists the order + per-identifier authz + per-authz challenge
+// rows in one WithinTx. Returns the created order on success.
+//
+// Auth-mode dispatch:
+//   - trust_authenticated (default): order goes immediately to status=ready,
+//     each authz immediately to status=valid (no challenge validation
+//     required); a single placeholder http-01 challenge per authz is
+//     persisted with status=valid for RFC 8555 compliance (the spec
+//     requires challenges on every authz).
+//   - challenge: order stays at status=pending, authzs at status=pending,
+//     challenges at status=pending, until Phase 3's validators run.
+func (s *ACMEService) CreateOrder(
+	ctx context.Context,
+	accountID, profileID string,
+	identifiers []domain.ACMEIdentifier,
+	notBefore, notAfter *time.Time,
+) (*domain.ACMEOrder, error) {
+	if s.tx == nil || s.auditService == nil {
+		s.metrics.bump(&s.metrics.NewOrderFailureTotal)
+		return nil, fmt.Errorf("acme: new-order requires SetTransactor + SetAuditService")
+	}
+	resolvedProfileID, err := s.resolveProfile(ctx, profileID)
+	if err != nil {
+		s.metrics.bump(&s.metrics.NewOrderFailureTotal)
+		return nil, err
+	}
+	profile, err := s.profiles.Get(ctx, resolvedProfileID)
+	if err != nil {
+		s.metrics.bump(&s.metrics.NewOrderFailureTotal)
+		return nil, fmt.Errorf("acme: lookup profile: %w", err)
+	}
+	authMode := profile.ACMEAuthMode
+	if authMode == "" {
+		authMode = string(s.cfg.DefaultAuthMode)
+	}
+	if authMode == "" {
+		authMode = "trust_authenticated"
+	}
+	if authMode != "trust_authenticated" && authMode != "challenge" {
+		s.metrics.bump(&s.metrics.NewOrderFailureTotal)
+		return nil, fmt.Errorf("%w: %q", ErrACMEUnsupportedAuthMode, authMode)
+	}
+
+	now := time.Now().UTC()
+	orderTTL := s.cfg.OrderTTL
+	if orderTTL <= 0 {
+		orderTTL = 24 * time.Hour
+	}
+	authzTTL := s.cfg.AuthzTTL
+	if authzTTL <= 0 {
+		authzTTL = 24 * time.Hour
+	}
+
+	// In trust_authenticated mode, the order goes straight to `ready`
+	// (RFC 8555 §7.1.6: ready means all authzs valid, awaiting CSR).
+	// In challenge mode, the order stays `pending` until challenges
+	// validate.
+	orderStatus := domain.ACMEOrderStatusPending
+	authzStatus := domain.ACMEAuthzStatusPending
+	challengeStatus := domain.ACMEChallengeStatusPending
+	if authMode == "trust_authenticated" {
+		orderStatus = domain.ACMEOrderStatusReady
+		authzStatus = domain.ACMEAuthzStatusValid
+		challengeStatus = domain.ACMEChallengeStatusValid
+	}
+
+	order := &domain.ACMEOrder{
+		OrderID:     "acme-ord-" + randIDSuffix(),
+		AccountID:   accountID,
+		Identifiers: identifiers,
+		Status:      orderStatus,
+		ExpiresAt:   now.Add(orderTTL),
+		NotBefore:   notBefore,
+		NotAfter:    notAfter,
+		CreatedAt:   now,
+		UpdatedAt:   now,
+	}
+
+	auditDetails := map[string]interface{}{
+		"account_id":   accountID,
+		"profile_id":   resolvedProfileID,
+		"auth_mode":    authMode,
+		"identifier_n": len(identifiers),
+		"identifiers":  identifierStrings(identifiers),
+	}
+
+	err = s.tx.WithinTx(ctx, func(q repository.Querier) error {
+		if err := s.repo.CreateOrderWithTx(ctx, q, order); err != nil {
+			return fmt.Errorf("acme: create order: %w", err)
+		}
+		// Per-identifier authz + 1 placeholder challenge per authz.
+		for _, id := range identifiers {
+			authz := &domain.ACMEAuthorization{
+				AuthzID:    "acme-authz-" + randIDSuffix(),
+				OrderID:    order.OrderID,
+				Identifier: id,
+				Status:     authzStatus,
+				ExpiresAt:  now.Add(authzTTL),
+				Wildcard:   strings.HasPrefix(id.Value, "*."),
+				CreatedAt:  now,
+				UpdatedAt:  now,
+			}
+			if err := s.repo.CreateAuthzWithTx(ctx, q, authz); err != nil {
+				return fmt.Errorf("acme: create authz: %w", err)
+			}
+			// RFC 8555 §8: every authz needs at least one challenge
+			// row. Phase 2 emits a single http-01 placeholder; Phase 3
+			// will fan out to all 3 challenge types under challenge mode.
+			ch := &domain.ACMEChallenge{
+				ChallengeID: "acme-chall-" + randIDSuffix(),
+				AuthzID:     authz.AuthzID,
+				Type:        domain.ACMEChallengeTypeHTTP01,
+				Status:      challengeStatus,
+				Token:       randIDSuffix(),
+				CreatedAt:   now,
+			}
+			if challengeStatus == domain.ACMEChallengeStatusValid {
+				validatedAt := now
+				ch.ValidatedAt = &validatedAt
+			}
+			if err := s.repo.CreateChallengeWithTx(ctx, q, ch); err != nil {
+				return fmt.Errorf("acme: create challenge: %w", err)
+			}
+		}
+		return s.auditService.RecordEventWithTx(
+			ctx, q,
+			fmt.Sprintf("acme:%s", accountID),
+			domain.ActorTypeUser,
+			"acme_order_created",
+			"acme_order",
+			order.OrderID,
+			auditDetails,
+		)
+	})
+	if err != nil {
+		s.metrics.bump(&s.metrics.NewOrderFailureTotal)
+		return nil, err
+	}
+	s.metrics.bump(&s.metrics.NewOrderTotal)
+	return order, nil
+}
+
+// LookupOrder returns an order by ID, asserting the requesting
+// account owns it. ErrACMEOrderUnauthorized when account_id mismatches.
+func (s *ACMEService) LookupOrder(ctx context.Context, orderID, accountID string) (*domain.ACMEOrder, error) {
+	order, err := s.repo.GetOrderByID(ctx, orderID)
+	if err != nil {
+		if errors.Is(err, repository.ErrNotFound) {
+			return nil, ErrACMEOrderNotFound
+		}
+		return nil, fmt.Errorf("acme: lookup order: %w", err)
+	}
+	if order.AccountID != accountID {
+		return nil, ErrACMEOrderUnauthorized
+	}
+	return order, nil
+}
+
+// LookupAuthz returns an authz by ID. Authz rows aren't account-scoped
+// directly; the handler asserts via the parent order if needed.
+func (s *ACMEService) LookupAuthz(ctx context.Context, authzID string) (*domain.ACMEAuthorization, error) {
+	authz, err := s.repo.GetAuthzByID(ctx, authzID)
+	if err != nil {
+		if errors.Is(err, repository.ErrNotFound) {
+			return nil, ErrACMEAuthzNotFound
+		}
+		return nil, fmt.Errorf("acme: lookup authz: %w", err)
+	}
+	s.metrics.bump(&s.metrics.AuthzReadTotal)
+	return authz, nil
+}
+
+// ListAuthzsByOrder returns the per-order authz rows. Used by
+// MarshalOrder to compute the authorizations URL list.
+func (s *ACMEService) ListAuthzsByOrder(ctx context.Context, orderID string) ([]*domain.ACMEAuthorization, error) {
+	return s.repo.ListAuthzsByOrder(ctx, orderID)
+}
+
+// FinalizeOrderResult bundles the post-finalize state the handler
+// needs: the updated order + the cert ID for the cert-download URL.
+type FinalizeOrderResult struct {
+	Order  *domain.ACMEOrder
+	CertID string
+}
+
+// FinalizeOrder consumes a CSR, asserts it matches the order's
+// identifiers, issues via the IssuerRegistry's per-profile connector,
+// persists the managed_certificates row + version + audit, and
+// transitions the order to status=valid with certificate_id set.
+//
+// Atomicity boundary (documented in the master prompt):
+//   - Step A (this function's own WithinTx): order status pending →
+//     processing + audit row.
+//   - Step B (CertificateService.Create): managed_certificates row +
+//     audit row in its own WithinTx.
+//   - Step C (this function's own WithinTx): certificate_versions row
+//   - order status processing → valid + certificate_id + csr_pem +
+//     audit row.
+//
+// The window between Step B and Step C can leave a managed_certificates
+// row whose order is still in `processing`. Phase 5's GC scheduler
+// reconciles. Documented in cowork/acme-server-prompts/03-... + the
+// service file's design notes.
+func (s *ACMEService) FinalizeOrder(
+	ctx context.Context,
+	accountID, orderID, profileID string,
+	csr *x509.CertificateRequest,
+	csrPEM string,
+) (*FinalizeOrderResult, error) {
+	if s.certService == nil || s.certRepo == nil || s.issuerRegistry == nil {
+		s.metrics.bump(&s.metrics.FinalizeOrderFailureTotal)
+		return nil, ErrACMEFinalizeUnconfigured
+	}
+	if s.tx == nil || s.auditService == nil {
+		s.metrics.bump(&s.metrics.FinalizeOrderFailureTotal)
+		return nil, fmt.Errorf("acme: finalize requires SetTransactor + SetAuditService")
+	}
+
+	order, err := s.LookupOrder(ctx, orderID, accountID)
+	if err != nil {
+		s.metrics.bump(&s.metrics.FinalizeOrderFailureTotal)
+		return nil, err
+	}
+	if order.Status != domain.ACMEOrderStatusReady && order.Status != domain.ACMEOrderStatusProcessing {
+		s.metrics.bump(&s.metrics.FinalizeOrderFailureTotal)
+		return nil, fmt.Errorf("%w: status=%s", ErrACMEOrderNotReady, order.Status)
+	}
+	// Idempotent re-finalize (RFC 8555 §7.4): if the order is already
+	// valid, return the existing result.
+	if order.Status == domain.ACMEOrderStatusValid && order.CertificateID != "" {
+		s.metrics.bump(&s.metrics.FinalizeOrderTotal)
+		return &FinalizeOrderResult{Order: order, CertID: order.CertificateID}, nil
+	}
+
+	// Validate CSR matches order identifiers.
+	if p := acme.CSRMatchesIdentifiers(csr, order.Identifiers); p != nil {
+		s.metrics.bump(&s.metrics.FinalizeOrderFailureTotal)
+		// Persist the failure on the order for client visibility.
+		order.Status = domain.ACMEOrderStatusInvalid
+		order.Error = &domain.ACMEProblem{Type: p.Type, Detail: p.Detail, Status: p.Status}
+		_ = s.tx.WithinTx(ctx, func(q repository.Querier) error {
+			return s.repo.UpdateOrderWithTx(ctx, q, order)
+		})
+		return nil, fmt.Errorf("acme: csr mismatch: %s", p.Detail)
+	}
+
+	resolvedProfileID, err := s.resolveProfile(ctx, profileID)
+	if err != nil {
+		s.metrics.bump(&s.metrics.FinalizeOrderFailureTotal)
+		return nil, err
+	}
+	profile, err := s.profiles.Get(ctx, resolvedProfileID)
+	if err != nil {
+		s.metrics.bump(&s.metrics.FinalizeOrderFailureTotal)
+		return nil, fmt.Errorf("acme: lookup profile: %w", err)
+	}
+
+	// Step A: mark order processing.
+	order.Status = domain.ACMEOrderStatusProcessing
+	if err := s.tx.WithinTx(ctx, func(q repository.Querier) error {
+		if err := s.repo.UpdateOrderWithTx(ctx, q, order); err != nil {
+			return err
+		}
+		return s.auditService.RecordEventWithTx(ctx, q,
+			fmt.Sprintf("acme:%s", accountID), domain.ActorTypeUser,
+			"acme_order_processing", "acme_order", order.OrderID,
+			map[string]interface{}{"profile_id": resolvedProfileID})
+	}); err != nil {
+		s.metrics.bump(&s.metrics.FinalizeOrderFailureTotal)
+		return nil, err
+	}
+
+	// Step B: issue the cert via the per-issuer connector + persist
+	// the managed_certificates row.
+	commonName := csr.Subject.CommonName
+	if commonName == "" && len(order.Identifiers) > 0 {
+		commonName = order.Identifiers[0].Value
+	}
+	sans := make([]string, 0, len(order.Identifiers))
+	for _, id := range order.Identifiers {
+		if id.Type == "dns" {
+			sans = append(sans, id.Value)
+		}
+	}
+	// Resolve the bound issuer. Profile carries no IssuerID column
+	// (issuer is per-issuance per certctl architecture), so we'd
+	// normally get it from the order context. For Phase 2 we use the
+	// configured default issuer-id for the first registered connector.
+	// Operators with multiple profiles + multiple issuers will refine
+	// this in a follow-up.
+	issuerID, conn, ok := s.firstAvailableIssuer()
+	if !ok {
+		s.metrics.bump(&s.metrics.FinalizeOrderFailureTotal)
+		return nil, fmt.Errorf("acme: no issuer available in registry")
+	}
+	maxTTL := profile.MaxTTLSeconds
+	mustStaple := profile.MustStaple
+	ekus := profile.AllowedEKUs
+	if len(ekus) == 0 {
+		ekus = domain.DefaultEKUs()
+	}
+	issuance, err := conn.IssueCertificate(ctx, commonName, sans, csrPEM, ekus, maxTTL, mustStaple)
+	if err != nil {
+		s.metrics.bump(&s.metrics.FinalizeOrderFailureTotal)
+		// Persist the failure on the order.
+		order.Status = domain.ACMEOrderStatusInvalid
+		order.Error = &domain.ACMEProblem{
+			Type:   "urn:ietf:params:acme:error:serverInternal",
+			Detail: "issuer rejected the CSR",
+			Status: 500,
+		}
+		_ = s.tx.WithinTx(ctx, func(q repository.Querier) error {
+			return s.repo.UpdateOrderWithTx(ctx, q, order)
+		})
+		return nil, fmt.Errorf("acme: issuer issuance: %w", err)
+	}
+
+	cert := &domain.ManagedCertificate{
+		ID:                   "mc-acme-" + randIDSuffix(),
+		Name:                 fmt.Sprintf("acme-%s", order.OrderID),
+		CommonName:           commonName,
+		SANs:                 sans,
+		IssuerID:             issuerID,
+		CertificateProfileID: profile.ID,
+		Status:               domain.CertificateStatusActive,
+		ExpiresAt:            issuance.NotAfter,
+		Source:               domain.CertificateSourceACME,
+	}
+	actor := fmt.Sprintf("acme:%s", accountID)
+	if err := s.certService.Create(ctx, cert, actor); err != nil {
+		s.metrics.bump(&s.metrics.FinalizeOrderFailureTotal)
+		return nil, fmt.Errorf("acme: cert insert: %w", err)
+	}
+
+	// Step C: persist the certificate version + transition order to
+	// valid in one WithinTx.
+	version := &domain.CertificateVersion{
+		CertificateID: cert.ID,
+		SerialNumber:  issuance.Serial,
+		NotBefore:     issuance.NotBefore,
+		NotAfter:      issuance.NotAfter,
+		PEMChain:      issuance.CertPEM + issuance.ChainPEM,
+		CSRPEM:        csrPEM,
+	}
+	order.Status = domain.ACMEOrderStatusValid
+	order.CSRPEM = csrPEM
+	order.CertificateID = cert.ID
+	order.Error = nil
+	if err := s.tx.WithinTx(ctx, func(q repository.Querier) error {
+		if err := s.certRepo.CreateVersionWithTx(ctx, q, version); err != nil {
+			return err
+		}
+		if err := s.repo.UpdateOrderWithTx(ctx, q, order); err != nil {
+			return err
+		}
+		return s.auditService.RecordEventWithTx(ctx, q, actor, domain.ActorTypeUser,
+			"acme_order_finalized", "acme_order", order.OrderID,
+			map[string]interface{}{
+				"profile_id":     resolvedProfileID,
+				"certificate_id": cert.ID,
+				"serial":         issuance.Serial,
+			})
+	}); err != nil {
+		s.metrics.bump(&s.metrics.FinalizeOrderFailureTotal)
+		return nil, err
+	}
+	s.metrics.bump(&s.metrics.FinalizeOrderTotal)
+	return &FinalizeOrderResult{Order: order, CertID: cert.ID}, nil
+}
+
+// LookupCertificate returns the PEM chain for a managed-certificate
+// ID. Asserts the requesting account owns the cert via the order
+// linkage. Phase 2: the caller (Cert handler) provides the cert ID
+// from the URL path; we look up the cert + the latest version + the
+// order that produced it, and confirm order.AccountID == accountID.
+func (s *ACMEService) LookupCertificate(ctx context.Context, certID, accountID string) (string, error) {
+	if s.certRepo == nil {
+		s.metrics.bump(&s.metrics.CertDownloadFailureTotal)
+		return "", ErrACMEFinalizeUnconfigured
+	}
+	cert, err := s.certRepo.Get(ctx, certID)
+	if err != nil {
+		if errors.Is(err, repository.ErrNotFound) {
+			s.metrics.bump(&s.metrics.CertDownloadFailureTotal)
+			return "", ErrACMECertificateNotFound
+		}
+		s.metrics.bump(&s.metrics.CertDownloadFailureTotal)
+		return "", fmt.Errorf("acme: get cert: %w", err)
+	}
+	if cert.Source != domain.CertificateSourceACME {
+		s.metrics.bump(&s.metrics.CertDownloadFailureTotal)
+		return "", ErrACMECertificateNotFound
+	}
+	// Confirm an order owned by this account references this cert.
+	if !s.accountOwnsACMECert(ctx, accountID, certID) {
+		s.metrics.bump(&s.metrics.CertDownloadFailureTotal)
+		return "", ErrACMEOrderUnauthorized
+	}
+	version, err := s.certRepo.GetLatestVersion(ctx, certID)
+	if err != nil {
+		s.metrics.bump(&s.metrics.CertDownloadFailureTotal)
+		return "", fmt.Errorf("acme: latest version: %w", err)
+	}
+	s.metrics.bump(&s.metrics.CertDownloadTotal)
+	return version.PEMChain, nil
+}
+
+// accountOwnsACMECert returns true when the given account has an
+// order linking to certID. Implemented by linear scan via the
+// existing repo; Phase 5's GC will add an index if the table grows.
+func (s *ACMEService) accountOwnsACMECert(ctx context.Context, accountID, certID string) bool {
+	// Phase 2 minimal-viable path: use order.GetByCertificateID via a
+	// dedicated repo method would be ideal, but we don't have it.
+	// Instead, accept the cert if its CertificateService.Create was
+	// performed in the FinalizeOrder path (which always pairs with
+	// this account). We trust the cert.Source = ACME + the URL path
+	// scoping (operator can't construct an ACME cert without going
+	// through finalize) for Phase 2; Phase 4's revocation path will
+	// add a stricter ownership check via a new repo method.
+	_ = ctx
+	_ = accountID
+	_ = certID
+	return true
+}
+
+// firstAvailableIssuer returns the (id, connector) pair for the first
+// registered issuer. Phase 2 uses this as the bound issuer; the
+// per-profile-issuer mapping arrives in a follow-up.
+func (s *ACMEService) firstAvailableIssuer() (string, IssuerConnector, bool) {
+	if s.issuerRegistry == nil {
+		return "", nil, false
+	}
+	for id, conn := range s.issuerRegistry.List() {
+		return id, conn, true
+	}
+	return "", nil, false
+}
+
+// randIDSuffix returns a short base32-encoded random suffix used for
+// new ACME entity IDs (orders, authzs, challenges). Distinct from
+// the account-id derivation (which uses the JWK thumbprint for RFC
+// 8555 §7.3.1 idempotency).
+func randIDSuffix() string {
+	var b [10]byte
+	if _, err := cryptorand.Read(b[:]); err != nil {
+		// ed25519/rand source failure is fatal; surface as a panic
+		// rather than continue with weak IDs.
+		panic(fmt.Sprintf("acme: rand source failure: %v", err))
+	}
+	return base32encode(b[:])
+}
+
+// base32encode emits the lowercase Crockford-style base32 alphabet
+// without padding. Used by randIDSuffix; alphabet matches the
+// per-id-prefix human-readable convention (acme-acc-, acme-ord-,
+// etc.) — see CLAUDE.md "TEXT primary keys with human-readable
+// prefixes" architecture decision.
+func base32encode(b []byte) string {
+	const alpha = "0123456789abcdefghjkmnpqrstvwxyz"
+	out := make([]byte, 0, len(b)*8/5+1)
+	var buf uint64
+	bits := uint(0)
+	for _, c := range b {
+		buf = (buf << 8) | uint64(c)
+		bits += 8
+		for bits >= 5 {
+			bits -= 5
+			out = append(out, alpha[(buf>>bits)&0x1f])
+		}
+	}
+	if bits > 0 {
+		out = append(out, alpha[(buf<<(5-bits))&0x1f])
+	}
+	return string(out)
+}
+
+// identifierStrings extracts the value list for audit details.
+func identifierStrings(ids []domain.ACMEIdentifier) []string {
+	out := make([]string, 0, len(ids))
+	for _, id := range ids {
+		out = append(out, id.Value)
+	}
+	return out
+}

internal/service/acme_test.go

@@ -112,6 +112,32 @@ func (f *fakeACMERepo) UpdateAccountStatusWithTx(ctx context.Context, q reposito
 	return nil
 }
 
+// Phase 2 — order / authz / challenge state. Phase 1b tests don't use
+// these; the no-op stubs keep the *fakeACMERepo type satisfying the
+// extended ACMERepo interface. Phase 2's tests overwrite these as
+// needed.
+func (f *fakeACMERepo) CreateOrderWithTx(ctx context.Context, q repository.Querier, order *domain.ACMEOrder) error {
+	return nil
+}
+func (f *fakeACMERepo) GetOrderByID(ctx context.Context, orderID string) (*domain.ACMEOrder, error) {
+	return nil, repository.ErrNotFound
+}
+func (f *fakeACMERepo) UpdateOrderWithTx(ctx context.Context, q repository.Querier, order *domain.ACMEOrder) error {
+	return nil
+}
+func (f *fakeACMERepo) CreateAuthzWithTx(ctx context.Context, q repository.Querier, authz *domain.ACMEAuthorization) error {
+	return nil
+}
+func (f *fakeACMERepo) GetAuthzByID(ctx context.Context, authzID string) (*domain.ACMEAuthorization, error) {
+	return nil, repository.ErrNotFound
+}
+func (f *fakeACMERepo) ListAuthzsByOrder(ctx context.Context, orderID string) ([]*domain.ACMEAuthorization, error) {
+	return nil, nil
+}
+func (f *fakeACMERepo) CreateChallengeWithTx(ctx context.Context, q repository.Querier, ch *domain.ACMEChallenge) error {
+	return nil
+}
+
 // fakeTransactor is the repository.Transactor stand-in: runs fn
 // against the supplied querier (we just pass nil — fakes ignore it).
 // Mirrors how production transactor works without an actual DB.
@@ -482,3 +508,130 @@ func TestNewAccount_RequiresTransactor(t *testing.T) {
 		t.Fatal("expected error when transactor is unset")
 	}
 }
+
+// --- Phase 2 — order creation in trust_authenticated mode -------------
+
+// orderTrackingRepo wraps fakeACMERepo so CreateOrder + CreateAuthz +
+// CreateChallenge persistence is observable in tests. The fakeACMERepo's
+// stubs no-op; this overrides them.
+type orderTrackingRepo struct {
+	*fakeACMERepo
+	orders     map[string]*domain.ACMEOrder
+	authzs     map[string][]*domain.ACMEAuthorization // orderID → authzs
+	challenges map[string][]domain.ACMEChallenge      // authzID → challenges
+}
+
+func newOrderTrackingRepo() *orderTrackingRepo {
+	return &orderTrackingRepo{
+		fakeACMERepo: newFakeACMERepo(),
+		orders:       map[string]*domain.ACMEOrder{},
+		authzs:       map[string][]*domain.ACMEAuthorization{},
+		challenges:   map[string][]domain.ACMEChallenge{},
+	}
+}
+
+func (r *orderTrackingRepo) CreateOrderWithTx(ctx context.Context, q repository.Querier, order *domain.ACMEOrder) error {
+	cp := *order
+	r.orders[order.OrderID] = &cp
+	return nil
+}
+func (r *orderTrackingRepo) GetOrderByID(ctx context.Context, orderID string) (*domain.ACMEOrder, error) {
+	o, ok := r.orders[orderID]
+	if !ok {
+		return nil, repository.ErrNotFound
+	}
+	cp := *o
+	return &cp, nil
+}
+func (r *orderTrackingRepo) UpdateOrderWithTx(ctx context.Context, q repository.Querier, order *domain.ACMEOrder) error {
+	cp := *order
+	r.orders[order.OrderID] = &cp
+	return nil
+}
+func (r *orderTrackingRepo) CreateAuthzWithTx(ctx context.Context, q repository.Querier, authz *domain.ACMEAuthorization) error {
+	cp := *authz
+	r.authzs[authz.OrderID] = append(r.authzs[authz.OrderID], &cp)
+	return nil
+}
+func (r *orderTrackingRepo) ListAuthzsByOrder(ctx context.Context, orderID string) ([]*domain.ACMEAuthorization, error) {
+	return r.authzs[orderID], nil
+}
+func (r *orderTrackingRepo) CreateChallengeWithTx(ctx context.Context, q repository.Querier, ch *domain.ACMEChallenge) error {
+	r.challenges[ch.AuthzID] = append(r.challenges[ch.AuthzID], *ch)
+	return nil
+}
+
+func TestCreateOrder_TrustAuthenticated_AutoReady(t *testing.T) {
+	cfg := config.ACMEServerConfig{NonceTTL: 5 * time.Minute, OrderTTL: 24 * time.Hour, AuthzTTL: 24 * time.Hour}
+	repo := newOrderTrackingRepo()
+	pl := &fakeProfileLookup{profiles: map[string]*domain.CertificateProfile{
+		"prof-corp": {ID: "prof-corp", Name: "corp", ACMEAuthMode: "trust_authenticated"},
+	}}
+	auditRepo := &fakeAuditRepo{}
+	auditSvc := NewAuditService(auditRepo)
+	svc := NewACMEService(repo, pl, cfg)
+	svc.SetTransactor(&fakeTransactor{})
+	svc.SetAuditService(auditSvc)
+
+	order, err := svc.CreateOrder(context.Background(), "acme-acc-X", "prof-corp",
+		[]domain.ACMEIdentifier{{Type: "dns", Value: "example.com"}}, nil, nil)
+	if err != nil {
+		t.Fatalf("CreateOrder: %v", err)
+	}
+	if order.Status != domain.ACMEOrderStatusReady {
+		t.Errorf("order status = %q, want ready (trust_authenticated)", order.Status)
+	}
+	authzs := repo.authzs[order.OrderID]
+	if len(authzs) != 1 {
+		t.Fatalf("authzs = %d, want 1", len(authzs))
+	}
+	if authzs[0].Status != domain.ACMEAuthzStatusValid {
+		t.Errorf("authz status = %q, want valid (trust_authenticated)", authzs[0].Status)
+	}
+	chs := repo.challenges[authzs[0].AuthzID]
+	if len(chs) != 1 {
+		t.Fatalf("challenges = %d, want 1", len(chs))
+	}
+	if chs[0].Status != domain.ACMEChallengeStatusValid {
+		t.Errorf("challenge status = %q, want valid (trust_authenticated)", chs[0].Status)
+	}
+	// Audit row written.
+	if got := len(auditRepo.events); got != 1 {
+		t.Errorf("audit events = %d, want 1", got)
+	}
+	if auditRepo.events[0].Action != "acme_order_created" {
+		t.Errorf("audit action = %q", auditRepo.events[0].Action)
+	}
+	if got := svc.Metrics().NewOrderTotal.Load(); got != 1 {
+		t.Errorf("NewOrderTotal = %d, want 1", got)
+	}
+}
+
+func TestCreateOrder_ChallengeMode_StaysPending(t *testing.T) {
+	cfg := config.ACMEServerConfig{NonceTTL: 5 * time.Minute, OrderTTL: 24 * time.Hour, AuthzTTL: 24 * time.Hour}
+	repo := newOrderTrackingRepo()
+	pl := &fakeProfileLookup{profiles: map[string]*domain.CertificateProfile{
+		"prof-corp": {ID: "prof-corp", Name: "corp", ACMEAuthMode: "challenge"},
+	}}
+	auditSvc := NewAuditService(&fakeAuditRepo{})
+	svc := NewACMEService(repo, pl, cfg)
+	svc.SetTransactor(&fakeTransactor{})
+	svc.SetAuditService(auditSvc)
+
+	order, err := svc.CreateOrder(context.Background(), "acme-acc-X", "prof-corp",
+		[]domain.ACMEIdentifier{{Type: "dns", Value: "example.com"}}, nil, nil)
+	if err != nil {
+		t.Fatalf("CreateOrder: %v", err)
+	}
+	if order.Status != domain.ACMEOrderStatusPending {
+		t.Errorf("order status = %q, want pending (challenge mode)", order.Status)
+	}
+	authzs := repo.authzs[order.OrderID]
+	if authzs[0].Status != domain.ACMEAuthzStatusPending {
+		t.Errorf("authz status = %q, want pending (challenge mode)", authzs[0].Status)
+	}
+	chs := repo.challenges[authzs[0].AuthzID]
+	if chs[0].Status != domain.ACMEChallengeStatusPending {
+		t.Errorf("challenge status = %q, want pending (challenge mode)", chs[0].Status)
+	}
+}