[PATCH pve-manager 2/2] fix #8006: api: acme: lifetime-based certificate renewal threshold

[David Riley <d.riley@proxmox.com>]

Replace the hardcoded 30-day renewal limit with a threshold based on
the certificate's actual lifetime.

The previous hardcoded limit caused excessive daily renewals for
short-lived certificates (e.g., 31 days). This change ensures they
renew at sensible intervals, avoiding upstream rate limits.

Link: https://bugzilla.proxmox.com/show_bug.cgi?id=8006

Signed-off-by: David Riley <d.riley@proxmox.com>
---
 PVE/API2/ACME.pm | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/PVE/API2/ACME.pm b/PVE/API2/ACME.pm
index a948a72a..4f2590f0 100644
--- a/PVE/API2/ACME.pm
+++ b/PVE/API2/ACME.pm
@@ -261,12 +261,15 @@ __PACKAGE__->register_method({
         raise("No current (custom) certificate found, please order a new certificate!\n")
             if !-e "${cert_prefix}.pem";
 
+        my $lead_time = PVE::Certificate::get_cert_renew_lead_time("${cert_prefix}.pem");
+        my $lead_days = int($lead_time / (24 * 60 * 60));
+
         my $expires_soon =
-            PVE::Certificate::check_expiry("${cert_prefix}.pem", time() + 30 * 24 * 60 * 60);
+            PVE::Certificate::check_expiry("${cert_prefix}.pem", time() + $lead_time);
         raise_param_exc(
             {
                 'force' =>
-                    "Certificate does not expire within the next 30 days, and 'force' is not set.",
+                    "Certificate does not expire within the next $lead_days days, and 'force' is not set.",
             },
         ) if !$expires_soon && !$param->{force};
 
-- 
2.47.3