diff --git a/backend/src/ee/services/pki-acme/pki-acme-service.ts b/backend/src/ee/services/pki-acme/pki-acme-service.ts
index e3b366d5b..4958308e1 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-service.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-service.ts
@@ -684,12 +684,11 @@ export const pkiAcmeServiceFactory = ({
             .map((san) => san.value.toLowerCase())
             .concat([certificateRequest.commonName!.toLowerCase()])
         );
-        const expectedIdentifierValues = new Set(
-          orderWithAuthorizations.authorizations.map((auth) => auth.identifierValue.toLowerCase())
-        );
         if (
-          csrIdentifierValues.size != expectedIdentifierValues.size ||
-          !csrIdentifierValues.isSubsetOf(expectedIdentifierValues)
+          csrIdentifierValues.size !== orderWithAuthorizations.authorizations.length ||
+          !orderWithAuthorizations.authorizations.every((auth) =>
+            csrIdentifierValues.has(auth.identifierValue.toLowerCase())
+          )
         ) {
           throw new AcmeBadCSRError({ detail: "Invalid CSR: Common name + SANs mismatch with order identifiers" });
         }