Re: applied: [PATCH proxmox-backup v2] acme: partially fix #6372: scale certificate renewal checks by lifetime

[Manuel Federanko <m.federanko@proxmox.com>]

On 2026-04-24 6:51 PM, Thomas Lamprecht wrote:
> On Thu, 23 Apr 2026 15:46:08 +0200, Manuel Federanko wrote:
>> Start renewing a certificate once 2/3 or 1/2 (for short-lived
>> certificates) of its total lifetime have passed, instead of the
>> hardcoded 30 days. This stays consistent with many certificates, which
>> are valid for 90 days and is recommended by letsencrypt [1].
>> 
>> The update service runs daily, impose a 3 day minimum remaining lifetime
>> to still be able to handle transient failures for certificate renewals.
>> 
>> [...]
> 
> Just again for the record: v1 was already applied when v2 landed, to avoid
> dropping v2, I pulled its improvements in as follow-ups on top of v1, so
> this should be basically (semantically) applied now too.
> 
> Follow-ups on top of v1 I pushed:
> 
> - 3ee7129c6 acme: certificates: update stale 30-day doc comments
> - 034652107 acme: certificates: warn on fallback to 30-day renewal lead time
> - cec290d10 acme: certificates: parse certificate once per renewal check
> - 3d819b132 acme: certificates: factor out SECONDS_PER_DAY constant
> 
> Ported from v2:
> 
> - 74bc33071 acme: certificates: use 1/2 lifetime lead for short-lived certs
> 
> I kept the 3-day floor inside cert_renew_lead_time rather than moving it to
> the daily-update caller as you did - behavior is equivalent for every
> lifetime, and it keeps the policy in one place with fewer cert reads per
> cycle.

thanks

> For the PDM port: the same improvements apply there too. One option would be
> to add a renewal_lead_time(&self) -> i64 helper on CertificateInfo in
> proxmox-acme-api::certificate_helpers, use it from PDM, and then switch PBS
> over to it here as well - single source of truth for both products.

yes, that makes sense