diff --git a/backend/bdd/features/pki/acme/new-order.feature b/backend/bdd/features/pki/acme/new-order.feature
index fee66245f..2b8115580 100644
--- a/backend/bdd/features/pki/acme/new-order.feature
+++ b/backend/bdd/features/pki/acme/new-order.feature
@@ -21,6 +21,23 @@ Feature: New Order
     Then the value order.body with jq .identifiers should be equal to [{"type": "dns", "value": "localhost"}]
     Then the value order.body with jq .finalize should match pattern {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/orders/(.+)/finalize
     Then the value order.body with jq all(.authorizations[]; startswith("{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/authorizations/")) should be equal to true
+
+  Scenario: Fetch an order
+    Given I have an ACME cert profile as "acme_profile"
+    When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
+#     # TODO: make it I have an account already instead?
+    Then I register a new ACME account with email fangpen@infisical.com and EAB key id {acme_profile.eab_kid} with secret {acme_profile.eab_secret} as acme_account
+    When I create certificate signing request as csr
+    Then I add names to certificate signing request csr
+      """
+      {
+        "ORGANIZATION_NAME": "Infisical Inc",
+        "COMMON_NAME": "localhost"
+      }
+      """
+    Then I create a RSA private key pair as cert_key
+    Then I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
+    Then I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
     Then I send an ACME post-as-get to order.uri as fetched_order
     Then the value fetched_order with jq .status should be equal to "pending"
     Then the value fetched_order with jq .identifiers should be equal to [{"type": "dns", "value": "localhost"}]
diff --git a/backend/src/ee/services/pki-acme/pki-acme-order-dal.ts b/backend/src/ee/services/pki-acme/pki-acme-order-dal.ts
index 78a46b665..70089c757 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-order-dal.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-order-dal.ts
@@ -1,10 +1,10 @@
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import { TableName, TPkiAcmeAuths } from "@app/db/schemas";
+import { TableName } from "@app/db/schemas";
 import { TPkiAcmeOrdersInsert, TPkiAcmeOrdersUpdate } from "@app/db/schemas/pki-acme-orders";
 import { DatabaseError } from "@app/lib/errors";
-import { ormify, selectAllTableCols } from "@app/lib/knex";
+import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
 
 export type TPkiAcmeOrderDALFactory = ReturnType<typeof pkiAcmeOrderDALFactory>;
 
@@ -53,7 +53,7 @@ export const pkiAcmeOrderDALFactory = (db: TDbClient) => {
 
   const findByAccountAndOrderIdWithAuthorizations = async (accountId: string, orderId: string, tx?: Knex) => {
     try {
-      const order = await (tx || db)(TableName.PkiAcmeOrder)
+      const rows = await (tx || db)(TableName.PkiAcmeOrder)
         .join(TableName.PkiAcmeOrderAuth, `${TableName.PkiAcmeOrderAuth}.orderId`, `${TableName.PkiAcmeOrder}.id`)
         .join(TableName.PkiAcmeAuth, `${TableName.PkiAcmeOrderAuth}.authId`, `${TableName.PkiAcmeAuth}.id`)
         .select(
@@ -61,24 +61,32 @@ export const pkiAcmeOrderDALFactory = (db: TDbClient) => {
           db.ref("id").withSchema(TableName.PkiAcmeAuth).as("authId"),
           db.ref("identifierType").withSchema(TableName.PkiAcmeAuth).as("identifierType"),
           db.ref("identifierValue").withSchema(TableName.PkiAcmeAuth).as("identifierValue"),
-          db.ref("expiresAt").withSchema(TableName.PkiAcmeAuth).as("expiresAt")
+          db.ref("expiresAt").withSchema(TableName.PkiAcmeAuth).as("authExpiresAt")
         )
         .where(`${TableName.PkiAcmeOrder}.id`, orderId)
         .where(`${TableName.PkiAcmeOrder}.accountId`, accountId)
-        .first();
+        .orderBy(`${TableName.PkiAcmeAuth}.identifierValue`, "asc");
 
-      if (!order) {
+      if (rows.length === 0) {
         return null;
       }
-      return {
-        ...order,
-        authorizations: order.authorizations.map((auth: TPkiAcmeAuths) => ({
-          id: auth.id,
-          identifierType: auth.identifierType,
-          identifierValue: auth.identifierValue,
-          expiresAt: auth.expiresAt
-        }))
-      };
+      return sqlNestRelationships({
+        data: rows,
+        key: "id",
+        parentMapper: (row) => row,
+        childrenMapper: [
+          {
+            key: "authId",
+            label: "authorizations" as const,
+            mapper: ({ authId, identifierType, identifierValue, authExpiresAt }) => ({
+              id: authId,
+              identifierType: identifierType,
+              identifierValue: identifierValue,
+              expiresAt: authExpiresAt
+            })
+          }
+        ]
+      })?.[0];
     } catch (error) {
       throw new DatabaseError({ error, name: "Find PKI ACME order by id" });
     }