diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5dd51ef16..20e82b5d7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,7 +10,8 @@ Certbot adheres to [Semantic Versioning](http://semver.org/).
 
 ### Changed
 
-*  `--manual` will explicitly warn users that earlier challenges should remain in place when setting up subsequent challenges.
+* Write README to the base of (config-dir)/live directory
+* `--manual` will explicitly warn users that earlier challenges should remain in place when setting up subsequent challenges.
 
 ### Fixed
 
diff --git a/acme/acme/messages.py b/acme/acme/messages.py
index 5be458580..7e86b0c3b 100644
--- a/acme/acme/messages.py
+++ b/acme/acme/messages.py
@@ -523,7 +523,7 @@ class Order(ResourceBody):
     """
     identifiers = jose.Field('identifiers', omitempty=True)
     status = jose.Field('status', decoder=Status.from_json,
-                        omitempty=True, default=STATUS_PENDING)
+                        omitempty=True)
     authorizations = jose.Field('authorizations', omitempty=True)
     certificate = jose.Field('certificate', omitempty=True)
     finalize = jose.Field('finalize', omitempty=True)
@@ -553,4 +553,3 @@ class OrderResource(ResourceWithURI):
 class NewOrder(Order):
     """New order."""
     resource_type = 'new-order'
-    resource = fields.Resource(resource_type)
diff --git a/certbot/storage.py b/certbot/storage.py
index 32d6771c2..c16ea35b8 100644
--- a/certbot/storage.py
+++ b/certbot/storage.py
@@ -214,6 +214,26 @@ def get_link_target(link):
         target = os.path.join(os.path.dirname(link), target)
     return os.path.abspath(target)
 
+def _write_live_readme_to(readme_path, is_base_dir=False):
+    prefix = ""
+    if is_base_dir:
+        prefix = "[cert name]/"
+    with open(readme_path, "w") as f:
+        logger.debug("Writing README to %s.", readme_path)
+        f.write("This directory contains your keys and certificates.\n\n"
+                "`{prefix}privkey.pem`  : the private key for your certificate.\n"
+                "`{prefix}fullchain.pem`: the certificate file used in most server software.\n"
+                "`{prefix}chain.pem`    : used for OCSP stapling in Nginx >=1.3.7.\n"
+                "`{prefix}cert.pem`     : will break many server configurations, and "
+                                    "should not be used\n"
+                "                 without reading further documentation (see link below).\n\n"
+                "WARNING: DO NOT MOVE OR RENAME THESE FILES!\n"
+                "         Certbot expects these files to remain in this location in order\n"
+                "         to function properly!\n\n"
+                "We recommend not moving these files. For more information, see the Certbot\n"
+                "User Guide at https://certbot.eff.org/docs/using.html#where-are-my-"
+                                    "certificates.\n".format(prefix=prefix))
+
 
 def _relevant(option):
     """
@@ -1003,6 +1023,9 @@ class RenewableCert(object):
                 logger.debug("Creating directory %s.", i)
         config_file, config_filename = util.unique_lineage_name(
             cli_config.renewal_configs_dir, lineagename)
+        base_readme_path = os.path.join(cli_config.live_dir, README)
+        if not os.path.exists(base_readme_path):
+            _write_live_readme_to(base_readme_path, is_base_dir=True)
 
         # Determine where on disk everything will go
         # lineagename will now potentially be modified based on which
@@ -1045,21 +1068,7 @@ class RenewableCert(object):
 
         # Write a README file to the live directory
         readme_path = os.path.join(live_dir, README)
-        with open(readme_path, "w") as f:
-            logger.debug("Writing README to %s.", readme_path)
-            f.write("This directory contains your keys and certificates.\n\n"
-                    "`privkey.pem`  : the private key for your certificate.\n"
-                    "`fullchain.pem`: the certificate file used in most server software.\n"
-                    "`chain.pem`    : used for OCSP stapling in Nginx >=1.3.7.\n"
-                    "`cert.pem`     : will break many server configurations, and "
-                                        "should not be used\n"
-                    "                 without reading further documentation (see link below).\n\n"
-                    "WARNING: DO NOT MOVE THESE FILES!\n"
-                    "         Certbot expects these files to remain in this location in order\n"
-                    "         to function properly!\n\n"
-                    "We recommend not moving these files. For more information, see the Certbot\n"
-                    "User Guide at https://certbot.eff.org/docs/using.html#where-are-my-"
-                                        "certificates.\n")
+        _write_live_readme_to(readme_path)
 
         # Document what we've done in a new renewal config file
         config_file.close()

Put a README in /etc/letsencrypt/live
In addition to putting a README in /etc/letsencrypt/live/example.com, a lot of people work directly in /etc/letsencrypt/live, so we should probably put a README in there telling people not to move certs.
diff --git a/acme/acme/messages_test.py b/acme/acme/messages_test.py
index 0e2d8c62d..876fbe825 100644
--- a/acme/acme/messages_test.py
+++ b/acme/acme/messages_test.py
@@ -424,6 +424,19 @@ class OrderResourceTest(unittest.TestCase):
             'authorizations': None,
         })
 
+class NewOrderTest(unittest.TestCase):
+    """Tests for acme.messages.NewOrder."""
+
+    def setUp(self):
+        from acme.messages import NewOrder
+        self.reg = NewOrder(
+            identifiers=mock.sentinel.identifiers)
+
+    def test_to_partial_json(self):
+        self.assertEqual(self.reg.to_json(), {
+            'identifiers': mock.sentinel.identifiers,
+        })
+
 
 if __name__ == '__main__':
     unittest.main()  # pragma: no cover
diff --git a/certbot/tests/storage_test.py b/certbot/tests/storage_test.py
index 53a976f8d..078a2858f 100644
--- a/certbot/tests/storage_test.py
+++ b/certbot/tests/storage_test.py
@@ -625,6 +625,8 @@ class RenewableCertTests(BaseRenewableCertTest):
         self.assertTrue(result._consistent())
         self.assertTrue(os.path.exists(os.path.join(
             self.config.renewal_configs_dir, "the-lineage.com.conf")))
+        self.assertTrue(os.path.exists(os.path.join(
+            self.config.live_dir, "README")))
         self.assertTrue(os.path.exists(os.path.join(
             self.config.live_dir, "the-lineage.com", "README")))
         with open(result.fullchain, "rb") as f:

pip install -e .[dev]
parse_log_pytest
requirements.txt
pytest pytest-cov pytest-xdist pytest-mock pytest-asyncio
apt-get update apt-get install -y gcc
3.9
requirements/base.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
acme==3.3.0
astroid==1.3.5
asttokens==3.0.0
backports.tarfile==1.2.0
cachetools==5.5.2
-e git+https://github.com/certbot/certbot.git@3de3188dd6fe4c8c9952848c155a56944b55ec2d#egg=certbot
certifi==2025.1.31
cffi==1.17.1
chardet==5.2.0
charset-normalizer==3.4.1
colorama==0.4.6
ConfigArgParse==1.7
configobj==5.0.9
coverage==7.8.0
cryptography==44.0.2
decorator==5.2.1
distlib==0.3.9
docutils==0.21.2
exceptiongroup==1.2.2
execnet==2.1.1
executing==2.2.0
filelock==3.18.0
id==1.5.0
idna==3.10
importlib-metadata==6.11.0
iniconfig==2.1.0
ipdb==0.13.13
ipython==8.18.1
jaraco.classes==3.4.0
jaraco.context==6.0.1
jaraco.functools==4.1.0
jedi==0.19.2
jeepney==0.9.0
josepy==1.15.0
keyring==25.6.0
logilab-common==2.1.0
markdown-it-py==3.0.0
matplotlib-inline==0.1.7
mdurl==0.1.2
mock==5.2.0
more-itertools==10.6.0
mypy-extensions==1.0.0
nh3==0.2.21
packaging==24.2
parsedatetime==2.6
parso==0.8.4
pexpect==4.9.0
platformdirs==4.3.7
pluggy==1.5.0
prompt_toolkit==3.0.50
ptyprocess==0.7.0
pure_eval==0.2.3
pycparser==2.22
Pygments==2.19.1
pylint==1.4.2
pyOpenSSL==25.0.0
pyproject-api==1.9.0
pyRFC3339==2.0.1
pytest==8.3.5
pytest-asyncio==0.26.0
pytest-cov==6.0.0
pytest-mock==3.14.0
pytest-xdist==3.6.1
pytz==2025.2
readme_renderer==44.0
requests==2.32.3
requests-toolbelt==1.0.0
rfc3986==2.0.0
rich==14.0.0
SecretStorage==3.3.3
six==1.17.0
stack-data==0.6.3
tomli==2.2.1
tox==4.25.0
traitlets==5.14.3
twine==6.1.0
typing_extensions==4.13.0
urllib3==2.3.0
virtualenv==20.29.3
wcwidth==0.2.13
zipp==3.21.0
zope.component==6.0
zope.event==5.0
zope.hookable==7.0
zope.interface==7.2

name: certbot
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=3.0.16=h5eee18b_0
  - pip=25.0=py39h06a4308_0
  - python=3.9.21=he870216_1
  - readline=8.2=h5eee18b_0
  - setuptools=75.8.0=py39h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - tzdata=2025a=h04d1e81_0
  - wheel=0.45.1=py39h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - acme==3.3.0
      - astroid==1.3.5
      - asttokens==3.0.0
      - backports-tarfile==1.2.0
      - cachetools==5.5.2
      - certifi==2025.1.31
      - cffi==1.17.1
      - chardet==5.2.0
      - charset-normalizer==3.4.1
      - colorama==0.4.6
      - configargparse==1.7
      - configobj==5.0.9
      - coverage==7.8.0
      - cryptography==44.0.2
      - decorator==5.2.1
      - distlib==0.3.9
      - docutils==0.21.2
      - exceptiongroup==1.2.2
      - execnet==2.1.1
      - executing==2.2.0
      - filelock==3.18.0
      - id==1.5.0
      - idna==3.10
      - importlib-metadata==6.11.0
      - iniconfig==2.1.0
      - ipdb==0.13.13
      - ipython==8.18.1
      - jaraco-classes==3.4.0
      - jaraco-context==6.0.1
      - jaraco-functools==4.1.0
      - jedi==0.19.2
      - jeepney==0.9.0
      - josepy==1.15.0
      - keyring==25.6.0
      - logilab-common==2.1.0
      - markdown-it-py==3.0.0
      - matplotlib-inline==0.1.7
      - mdurl==0.1.2
      - mock==5.2.0
      - more-itertools==10.6.0
      - mypy-extensions==1.0.0
      - nh3==0.2.21
      - packaging==24.2
      - parsedatetime==2.6
      - parso==0.8.4
      - pexpect==4.9.0
      - platformdirs==4.3.7
      - pluggy==1.5.0
      - prompt-toolkit==3.0.50
      - ptyprocess==0.7.0
      - pure-eval==0.2.3
      - pycparser==2.22
      - pygments==2.19.1
      - pylint==1.4.2
      - pyopenssl==25.0.0
      - pyproject-api==1.9.0
      - pyrfc3339==2.0.1
      - pytest==8.3.5
      - pytest-asyncio==0.26.0
      - pytest-cov==6.0.0
      - pytest-mock==3.14.0
      - pytest-xdist==3.6.1
      - pytz==2025.2
      - readme-renderer==44.0
      - requests==2.32.3
      - requests-toolbelt==1.0.0
      - rfc3986==2.0.0
      - rich==14.0.0
      - secretstorage==3.3.3
      - six==1.17.0
      - stack-data==0.6.3
      - tomli==2.2.1
      - tox==4.25.0
      - traitlets==5.14.3
      - twine==6.1.0
      - typing-extensions==4.13.0
      - urllib3==2.3.0
      - virtualenv==20.29.3
      - wcwidth==0.2.13
      - zipp==3.21.0
      - zope-component==6.0
      - zope-event==5.0
      - zope-hookable==7.0
      - zope-interface==7.2
prefix: /opt/conda/envs/certbot

acme/acme/messages_test.py::NewOrderTest::test_to_partial_json certbot/tests/storage_test.py::RenewableCertTests::test_new_lineage
acme/acme/messages_test.py::ErrorTest::test_code acme/acme/messages_test.py::ErrorTest::test_default_typ acme/acme/messages_test.py::ErrorTest::test_description acme/acme/messages_test.py::ErrorTest::test_from_json_empty acme/acme/messages_test.py::ErrorTest::test_from_json_hashable acme/acme/messages_test.py::ErrorTest::test_is_acme_error acme/acme/messages_test.py::ErrorTest::test_str acme/acme/messages_test.py::ErrorTest::test_unicode_error acme/acme/messages_test.py::ErrorTest::test_with_code acme/acme/messages_test.py::ConstantTest::test_equality acme/acme/messages_test.py::ConstantTest::test_from_json acme/acme/messages_test.py::ConstantTest::test_from_json_hashable acme/acme/messages_test.py::ConstantTest::test_repr acme/acme/messages_test.py::ConstantTest::test_to_partial_json acme/acme/messages_test.py::DirectoryTest::test_from_json_deserialization_unknown_key_success acme/acme/messages_test.py::DirectoryTest::test_getattr acme/acme/messages_test.py::DirectoryTest::test_getattr_fails_with_attribute_error acme/acme/messages_test.py::DirectoryTest::test_getitem acme/acme/messages_test.py::DirectoryTest::test_getitem_fails_with_key_error acme/acme/messages_test.py::DirectoryTest::test_init_wrong_key_value_success acme/acme/messages_test.py::DirectoryTest::test_iter_meta acme/acme/messages_test.py::DirectoryTest::test_to_json acme/acme/messages_test.py::RegistrationTest::test_emails acme/acme/messages_test.py::RegistrationTest::test_from_data acme/acme/messages_test.py::RegistrationTest::test_from_json acme/acme/messages_test.py::RegistrationTest::test_from_json_hashable acme/acme/messages_test.py::RegistrationTest::test_phones acme/acme/messages_test.py::RegistrationTest::test_to_partial_json acme/acme/messages_test.py::UpdateRegistrationTest::test_empty acme/acme/messages_test.py::RegistrationResourceTest::test_to_partial_json acme/acme/messages_test.py::ChallengeResourceTest::test_uri acme/acme/messages_test.py::ChallengeBodyTest::test_encode acme/acme/messages_test.py::ChallengeBodyTest::test_from_json acme/acme/messages_test.py::ChallengeBodyTest::test_from_json_hashable acme/acme/messages_test.py::ChallengeBodyTest::test_proxy acme/acme/messages_test.py::ChallengeBodyTest::test_to_partial_json acme/acme/messages_test.py::AuthorizationTest::test_from_json acme/acme/messages_test.py::AuthorizationTest::test_from_json_hashable acme/acme/messages_test.py::AuthorizationTest::test_resolved_combinations acme/acme/messages_test.py::AuthorizationResourceTest::test_json_de_serializable acme/acme/messages_test.py::CertificateRequestTest::test_json_de_serializable acme/acme/messages_test.py::CertificateResourceTest::test_json_de_serializable acme/acme/messages_test.py::RevocationTest::test_from_json_hashable acme/acme/messages_test.py::OrderResourceTest::test_to_partial_json certbot/tests/storage_test.py::RenewableCertTests::test_add_time_interval certbot/tests/storage_test.py::RenewableCertTests::test_autodeployment_is_enabled certbot/tests/storage_test.py::RenewableCertTests::test_autorenewal_is_enabled certbot/tests/storage_test.py::RenewableCertTests::test_bad_kind certbot/tests/storage_test.py::RenewableCertTests::test_consistent certbot/tests/storage_test.py::RenewableCertTests::test_current_target certbot/tests/storage_test.py::RenewableCertTests::test_current_version certbot/tests/storage_test.py::RenewableCertTests::test_ensure_deployed certbot/tests/storage_test.py::RenewableCertTests::test_has_pending_deployment certbot/tests/storage_test.py::RenewableCertTests::test_initialization certbot/tests/storage_test.py::RenewableCertTests::test_invalid_config_filename certbot/tests/storage_test.py::RenewableCertTests::test_is_test_cert certbot/tests/storage_test.py::RenewableCertTests::test_latest_and_next_versions certbot/tests/storage_test.py::RenewableCertTests::test_missing_cert certbot/tests/storage_test.py::RenewableCertTests::test_names certbot/tests/storage_test.py::RenewableCertTests::test_new_lineage_nonexistent_dirs certbot/tests/storage_test.py::RenewableCertTests::test_no_current_version certbot/tests/storage_test.py::RenewableCertTests::test_no_renewal_version certbot/tests/storage_test.py::RenewableCertTests::test_ocsp_revoked certbot/tests/storage_test.py::RenewableCertTests::test_relevant_values certbot/tests/storage_test.py::RenewableCertTests::test_relevant_values_bool certbot/tests/storage_test.py::RenewableCertTests::test_relevant_values_default certbot/tests/storage_test.py::RenewableCertTests::test_relevant_values_namespace certbot/tests/storage_test.py::RenewableCertTests::test_relevant_values_nondefault certbot/tests/storage_test.py::RenewableCertTests::test_relevant_values_plugins_none certbot/tests/storage_test.py::RenewableCertTests::test_relevant_values_server certbot/tests/storage_test.py::RenewableCertTests::test_relevant_values_str certbot/tests/storage_test.py::RenewableCertTests::test_renewal_bad_config certbot/tests/storage_test.py::RenewableCertTests::test_renewal_incomplete_config certbot/tests/storage_test.py::RenewableCertTests::test_renewal_newer_version certbot/tests/storage_test.py::RenewableCertTests::test_save_successor certbot/tests/storage_test.py::RenewableCertTests::test_should_autodeploy certbot/tests/storage_test.py::RenewableCertTests::test_should_autorenew certbot/tests/storage_test.py::RenewableCertTests::test_time_interval_judgments certbot/tests/storage_test.py::RenewableCertTests::test_update_all_links_to_full_failure certbot/tests/storage_test.py::RenewableCertTests::test_update_all_links_to_partial_failure certbot/tests/storage_test.py::RenewableCertTests::test_update_all_links_to_success certbot/tests/storage_test.py::RenewableCertTests::test_update_link_to certbot/tests/storage_test.py::RenewableCertTests::test_update_symlinks certbot/tests/storage_test.py::RenewableCertTests::test_version certbot/tests/storage_test.py::RenewableCertTests::test_write_renewal_config certbot/tests/storage_test.py::DeleteFilesTest::test_bad_renewal_config certbot/tests/storage_test.py::DeleteFilesTest::test_delete_all_files certbot/tests/storage_test.py::DeleteFilesTest::test_livedir_not_empty certbot/tests/storage_test.py::DeleteFilesTest::test_no_archive certbot/tests/storage_test.py::DeleteFilesTest::test_no_cert_file certbot/tests/storage_test.py::DeleteFilesTest::test_no_readme_file certbot/tests/storage_test.py::DeleteFilesTest::test_no_renewal_config certbot/tests/storage_test.py::CertPathForCertNameTest::test_no_such_cert_name certbot/tests/storage_test.py::CertPathForCertNameTest::test_simple_cert_name
certbot/storage.py acme/acme/messages.py CHANGELOG.md
certbot/storage.py acme/acme/messages.py CHANGELOG.md