Save auto_ssl_failed if acme order is invalid

app/services/pages_domains/obtain_lets_encrypt_certificate_service.rb

@@ -36,8 +36,8 @@ module PagesDomains
       when 'valid'
         save_certificate(acme_order.private_key, api_order)
         acme_order.destroy!
-        # when 'invalid'
-        # TODO: implement error handling
+      when 'invalid'
+        save_order_error(acme_order)
       end
     end
 
@@ -47,5 +47,12 @@ module PagesDomains
       certificate = api_order.certificate
       pages_domain.update!(gitlab_provided_key: private_key, gitlab_provided_certificate: certificate)
     end
+
+    def save_order_error(acme_order)
+      return unless Feature.enabled?(:pages_letsencrypt_errors, pages_domain.project)
+
+      acme_order.pages_domain.update_column(:auto_ssl_failed, true)
+      acme_order.destroy!
+    end
   end
 end

spec/services/pages_domains/obtain_lets_encrypt_certificate_service_spec.rb

@@ -163,4 +163,22 @@ describe PagesDomains::ObtainLetsEncryptCertificateService do
       expect(PagesDomainAcmeOrder.find_by_id(existing_order.id)).to be_nil
     end
   end
+
+  context 'when order is invalid' do
+    let(:existing_order) do
+      create(:pages_domain_acme_order, pages_domain: pages_domain)
+    end
+
+    let!(:api_order) do
+      stub_lets_encrypt_order(existing_order.url, 'invalid')
+    end
+
+    it 'saves error to domain and deletes acme order' do
+      expect do
+        service.execute
+      end.to change { pages_domain.reload.auto_ssl_failed }.from(false).to(true)
+
+      expect(PagesDomainAcmeOrder.find_by_id(existing_order.id)).to be_nil
+    end
+  end
 end