From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 2A69C1FF0AA for ; Tue, 20 Oct 2026 15:34:17 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id E1872216D1; Tue, 20 Oct 2026 15:34:14 +0200 (CEST) Content-Type: text/plain; charset=UTF-8 Date: Tue, 20 Oct 2026 15:34:10 +0200 Message-Id: To: "David Riley" , Subject: Re: [PATCH pve-common v2 1/2] certificate: add helpers for lifetime-based ACME renewal From: =?utf-8?q?Michael_K=C3=B6ppl?= Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 X-Mailer: aerc 0.22.0 References: <20261020082415.35215-1-d.riley@proxmox.com> <20261020082415.35215-2-d.riley@proxmox.com> In-Reply-To: <20261020082415.35215-2-d.riley@proxmox.com> X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1792503251079 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.242 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: L5W6YSQ6M7OVV6HV6MZDU4CTZANYJ7IO X-Message-ID-Hash: L5W6YSQ6M7OVV6HV6MZDU4CTZANYJ7IO X-MailFrom: m.koeppl@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: nit: I think this would also benefit from being split into 2 commits, with the first adding get_validity_as_epoch and adapting get_expiration_as_epoch to use it, and the second commit adding the actual renewal helper. It's definitely not a blocker IMO, it just seems a bit misleading to me right now as the commit messages says that only a new helper is added, suggesting that existing behavior doesn't change, but it does. On Tue Oct 20, 2026 at 10:24 AM CEST, David Riley wrote: > Add helpers to calculate a renewal lead time based on the actual > lifetime of an X.509 certificate. > > Previously, certificate renewals relied on a hardcoded threshold. > To prepare for dynamic thresholds (#8006), introduce calculations > that scale the renewal lead time proportionally to the certificate's > validity period. > > The scaling mirrors the logic already used in Proxmox Backup Server > [1]: certificates living for less than 10 days are renewed once 1/2 of > their lifetime has elapsed, while longer-lived certificates are > renewed once 2/3 has elapsed [2]. A 3-day minimum floor is present to > ensure the daily update service has multiple chances to retry > transient failures. > [snip]