Re: [PATCH pve-common v2 1/2] certificate: add helpers for lifetime-based ACME renewal

["Michael Köppl" <m.koeppl@proxmox.com>]

nit: I think this would also benefit from being split into 2 commits,
with the first adding get_validity_as_epoch and adapting
get_expiration_as_epoch to use it, and the second commit adding the
actual renewal helper. It's definitely not a blocker IMO, it just seems
a bit misleading to me right now as the commit messages says that only
a new helper is added, suggesting that existing behavior doesn't change,
but it does.

On Tue Oct 20, 2026 at 10:24 AM CEST, David Riley wrote:
> Add helpers to calculate a renewal lead time based on the actual
> lifetime of an X.509 certificate.
>
> Previously, certificate renewals relied on a hardcoded threshold.
> To prepare for dynamic thresholds (#8006), introduce calculations
> that scale the renewal lead time proportionally to the certificate's
> validity period.
>
> The scaling mirrors the logic already used in Proxmox Backup Server
> [1]: certificates living for less than 10 days are renewed once 1/2 of
> their lifetime has elapsed, while longer-lived certificates are
> renewed once 2/3 has elapsed [2]. A 3-day minimum floor is present to
> ensure the daily update service has multiple chances to retry
> transient failures.
>

[snip]