code: func (ra *RegistrationAuthorityImpl) createPendingAuthz(ctx context.Context, reg int64, identifier core.AcmeIdentifier, v2 bool) (*corepb.Authorization, error) {
  	expires := ra.clk.Now().Add(ra.pendingAuthorizationLifetime).Truncate(time.Second).UnixNano()
  	status := string(core.StatusPending)
  	authz := &corepb.Authorization{
  		Identifier:     &identifier.Value,
  		RegistrationID: &reg,
  		Status:         &status,
  		Expires:        &expires,
  		V2:             &v2,
  	}
  
  	// Create challenges. The WFE will update them with URIs before sending them out.
  	challenges, err := ra.PA.ChallengesFor(identifier)
  	if err != nil {
  		// The only time ChallengesFor errors it is a fatal configuration error
  		// where challenges required by policy for an identifier are not enabled. We
  		// want to treat this as an internal server error.
  		return nil, berrors.InternalServerError(err.Error())
  	}
  	// Check each challenge for sanity.
  	for _, challenge := range challenges {
  		if err := challenge.CheckConsistencyForClientOffer(); err != nil {
  			// berrors.InternalServerError because we generated these challenges, they should
  			// be OK.
  			err = berrors.InternalServerError("challenge didn't pass sanity check: %+v", challenge)
  			return nil, err
  		}
  		challPB, err := bgrpc.ChallengeToPB(challenge)
  		if err != nil {
  			return nil, err
  		}
  		authz.Challenges = append(authz.Challenges, challPB)
  	}
  	return authz, nil
  }
docs: // createPendingAuthz checks that a name is allowed for issuance and creates the
  // necessary challenges for it and puts this and all of the relevant information
  // into a corepb.Authorization for transmission to the SA to be stored