Re: [PATCH pve-manager 2/2] fix #8006: api: acme: lifetime-based certificate renewal threshold

["Michael Köppl" <m.koeppl@proxmox.com>]

On Tue Oct 6, 2026 at 2:31 PM CEST, David Riley wrote:
> Replace the hardcoded 30-day renewal limit with a threshold based on
> the certificate's actual lifetime.
>
> The previous hardcoded limit caused excessive daily renewals for
> short-lived certificates (e.g., 31 days). This change ensures they
> renew at sensible intervals, avoiding upstream rate limits.
>
> Link: https://bugzilla.proxmox.com/show_bug.cgi?id=8006
>
> Signed-off-by: David Riley <d.riley@proxmox.com>
> ---
>  PVE/API2/ACME.pm | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/PVE/API2/ACME.pm b/PVE/API2/ACME.pm
> index a948a72a..4f2590f0 100644
> --- a/PVE/API2/ACME.pm
> +++ b/PVE/API2/ACME.pm
> @@ -261,12 +261,15 @@ __PACKAGE__->register_method({
>          raise("No current (custom) certificate found, please order a new certificate!\n")
>              if !-e "${cert_prefix}.pem";
>
> +        my $lead_time = PVE::Certificate::get_cert_renew_lead_time("${cert_prefix}.pem");
> +        my $lead_days = int($lead_time / (24 * 60 * 60));
> +
>          my $expires_soon =
> -            PVE::Certificate::check_expiry("${cert_prefix}.pem", time() + 30 * 24 * 60 * 60);
> +            PVE::Certificate::check_expiry("${cert_prefix}.pem", time() + $lead_time);

Should this perhaps also be done for bin/pveupdate? It still uses the
hard-coded 30 days and the PBS patch you're referring to in the cover
letter also updates its daily job.

>          raise_param_exc(
>              {
>                  'force' =>
> -                    "Certificate does not expire within the next 30 days, and 'force' is not set.",
> +                    "Certificate does not expire within the next $lead_days days, and 'force' is not set.",

This should also be done for the description of the 'force' param. It
still reads "... is more than 30 days away".

>              },
>          ) if !$expires_soon && !$param->{force};
>