diff --git a/src/acme.c b/src/acme.c
index def664aa7..5d5bfa7d3 100644
--- a/src/acme.c
+++ b/src/acme.c
@@ -2127,10 +2127,25 @@ int acme_res_neworder(struct task *task, struct acme_ctx *ctx, char **errmsg)
 		goto error;
 	}
 
+	/* if the order already has a certificate URL, the validation was
+	 * already done: skip the auth/challenge steps entirely */
+	ret = mjson_get_string(hc->res.buf.area, hc->res.buf.data, "$.certificate", trash.area, trash.size);
+	if (ret != -1) {
+		trash.data = ret;
+		istfree(&ctx->certificate);
+		ctx->certificate = istdup(ist2(trash.area, trash.data));
+		if (!isttest(ctx->certificate)) {
+			memprintf(errmsg, "out of memory");
+			goto error;
+		}
+		goto end;
+	}
+
 	if (!isttest(ctx->order)) {
 		memprintf(errmsg, "couldn't get an order Location during newOrder");
 		goto error;
 	}
+
 	/* get the multiple authorizations URL and tokens */
 	for (i = 0; ; i++) {
 		struct acme_auth *auth;
@@ -2179,7 +2194,7 @@ int acme_res_neworder(struct task *task, struct acme_ctx *ctx, char **errmsg)
 		memprintf(errmsg, "out of memory");
 		goto error;
 	}
-
+end:
 	ret = 0;
 
 error:
@@ -2497,7 +2512,7 @@ re:
 				if (acme_res_neworder(task, ctx, &errmsg) != 0) {
 					goto retry;
 				}
-				st = ACME_AUTH;
+				st = isttest(ctx->certificate) ? ACME_CERTIFICATE : ACME_AUTH;
 				goto nextreq;
 			}
 		break;