Don't retry acme orders if auto_ssl is not enabled or not failed yet

app/services/pages_domains/retry_acme_order_service.rb

@@ -9,10 +9,13 @@ module PagesDomains
     end
 
     def execute
-      pages_domain.update!(auto_ssl_failed: false)
+      updated = pages_domain.with_lock do
+        next unless pages_domain.auto_ssl_enabled && pages_domain.auto_ssl_failed
 
-      # Don't schedule worker if already have acme order to prevent users from abusing retries
-      PagesDomainSslRenewalWorker.perform_async(pages_domain.id) unless pages_domain.acme_orders.exists?
+        pages_domain.update!(auto_ssl_failed: false)
+      end
+
+      PagesDomainSslRenewalWorker.perform_async(pages_domain.id) if updated
     end
   end
 end

spec/services/pages_domains/retry_acme_order_service_spec.rb

@@ -19,8 +19,16 @@ describe PagesDomains::RetryAcmeOrderService do
     service.execute
   end
 
-  it "doesn't schedule renewal worker if acme order is already present" do
-    create(:pages_domain_acme_order, pages_domain: domain)
+  it "doesn't schedule renewal worker if Let's Encrypt integration is not enabled" do
+    domain.update!(auto_ssl_enabled: false)
+
+    expect(PagesDomainSslRenewalWorker).not_to receive(:new)
+
+    service.execute
+  end
+
+  it "doesn't schedule renewal worker if auto ssl has not failed yet" do
+    domain.update!(auto_ssl_failed: false)
 
     expect(PagesDomainSslRenewalWorker).not_to receive(:new)