Exempt ARI renewals from on-demand blocklisting (#8655)

aarongable · web-flow · commit 14a05d3ab45a · 2026-03-03T10:15:06.000-08:00
diff --git a/wfe2/wfe.go b/wfe2/wfe.go
@@ -2400,7 +2400,7 @@ func (wfe *WebFrontEndImpl) NewOrder(
 		isRenewal = len(timestamps.Timestamps) > 0
 	}
 
-	if !isRenewal {
+	if !isRenewal && !isARIRenewal {
 		err = looksLikeRecursiveOnDemandRequest(idents, wfe.blockedOnDemandLabels)
 		if err != nil {
 			wfe.sendError(response, logEvent, web.ProblemDetailsForError(err, "Disallowed identifier requested"), nil)

Original file line number	Diff line number	Diff line change
`@@ -2400,7 +2400,7 @@ func (wfe *WebFrontEndImpl) NewOrder(`
`2400`	`2400`	`isRenewal = len(timestamps.Timestamps) > 0`
`2401`	`2401`	`}`
`2402`	`2402`
`2403`		`- if !isRenewal {`
	`2403`	`+ if !isRenewal && !isARIRenewal {`
`2404`	`2404`	`err = looksLikeRecursiveOnDemandRequest(idents, wfe.blockedOnDemandLabels)`
`2405`	`2405`	`if err != nil {`
`2406`	`2406`	`wfe.sendError(response, logEvent, web.ProblemDetailsForError(err, "Disallowed identifier requested"), nil)`