Re: [PATCH common/manager v2 0/2] fix #8006: acme: lifetime-based certificate renewal threshold

["Michael Köppl" <m.koeppl@proxmox.com>]

Tested this version as well, running through the following scenarios:
- Checked that with only 72h remaining, certs are always considered due
  for renewal and are renewed by pveupdate. Generated a couple of
  certs for this at 24h, 72h, 96h. For 96h the scaling should use 2, so
  48h, but the floor raises this to 72h. So I forwarded time by 23h,
  such that the certificate was not considered due for renewal yet and
  thus refused. At 24h(+1s) after issuance and every point after,
  renewal worked. Works as expected!
- Also checked that the scaling works by using a 216h and a 240h
  certificate, with the switch to 1/3 scaling being applied to 240h
  and longer-lived certs.
- Just to be sure (and because I wanted to try), I also used pebble [0]
  and configured it to use 96h certs and ran renewals again at the 3-day
  floor. Also had it issue longer-lived certificates and tried to make
  it miss/fail renewal, but couldn't.

I also had a look at the code and left some minor comments regarding
the structure of the series. The implementation itself looks good to me
now.

Consider this:
Reviewed-by: Michael Köppl <m.koeppl@proxmox.com>
Tested-by: Michael Köppl <m.koeppl@proxmox.com>

[0] https://github.com/letsencrypt/pebble

On Tue Oct 20, 2026 at 10:24 AM CEST, David Riley wrote:
> Thanks Michael K. for taking a look.
>
> Differences from v1:
> * Refactor: Reduce certificate reads by combining the read of
>   notBefore and notAfter.
> * Add: Warning users of certificates with lifetime <= 0
> * Add: minimum lead time of 3 days
> * Update 'force' parameter description in API schema

[snip]