From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 3A06F1FF0AA for ; Tue, 20 Oct 2026 10:24:58 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 9E14B21676; Tue, 20 Oct 2026 10:24:48 +0200 (CEST) From: David Riley To: pve-devel@lists.proxmox.com Subject: [PATCH common/manager v2 0/2] fix #8006: acme: lifetime-based certificate renewal threshold Date: Tue, 20 Oct 2026 10:24:13 +0200 Message-ID: <20261020082415.35215-1-d.riley@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1792484677308 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.708 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: STKBZHO63YGSKAJADYSNAQ4URITVUUOS X-Message-ID-Hash: STKBZHO63YGSKAJADYSNAQ4URITVUUOS X-MailFrom: d.riley@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: David Riley X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Thanks Michael K. for taking a look. Differences from v1: * Refactor: Reduce certificate reads by combining the read of notBefore and notAfter. * Add: Warning users of certificates with lifetime <= 0 * Add: minimum lead time of 3 days * Update 'force' parameter description in API schema * Add: dynamic lead time calculation to bin/pveupdate Note on short-lived certificates: Because pveupdate runs daily and there is a 3-day minimum lead time, short-lived certificates (e.g., 24h, 48h) will get renewed every day and therefore might be limited by upstream rate limiting. Supporting such short-lived certificates safely will require both implementing ARI [3] and adjusting the renewal check frequency. Dependencies: pve-manager requires a versioned dependency bump on libpve-common-perl for the new helper. --- Original Cover Letter: This patch series addresses an issue where short-lived ACME certificates (e.g., 31-day validity) trigger daily renewal attempts due to PVE's hardcoded 30-day threshold. Because PVE currently relies on non-ARI renewal logic, these daily attempts quickly exhaust upstream rate limits. With Let's Encrypt, for example, this would hit their duplicate certificate limit (5 renewals per exact set of identifiers per 7 days) [0], resulting in blocked issuances. To prevent hitting these upstream limits, the static threshold is replaced with a dynamic one based on the certificate's actual lifetime (notAfter - notBefore) [1]. The scaling mirrors the logic already present in Proxmox Backup Server [2]. This is intended as a stop-gap measure to gracefully handle the shift toward shorter-lived certificates until the full ACME Renewal Information (ARI) [3] flow is implemented. Link: https://bugzilla.proxmox.com/show_bug.cgi?id=8006 [0] https://letsencrypt.org/docs/rate-limits/#new-certificates-per-exact-set-of-identifiers [1] https://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt [2] https://lore.proxmox.com/pbs-devel/20260423134607.105229-2-m.federanko@proxmox.com/ [3] https://www.rfc-editor.org/rfc/rfc9773.html pve-common: David Riley (1): certificate: add helpers for lifetime-based ACME renewal src/PVE/Certificate.pm | 39 +++++++++++++++++++++++++++++++++++++-- 1 file changed, 37 insertions(+), 2 deletions(-) pve-manager: David Riley (1): fix #8006: api: acme: lifetime-based certificate renewal threshold PVE/API2/ACME.pm | 10 ++++++---- bin/pveupdate | 4 +++- 2 files changed, 9 insertions(+), 5 deletions(-) Summary over all repositories: 3 files changed, 46 insertions(+), 7 deletions(-) -- Generated by murpp 0.11.0