Re: [PATCH proxmox-backup] acme: partially fix #6372: scale certificate renewal checks by lifetime

[Manuel Federanko <m.federanko@proxmox.com>]

On 2026-04-22 11:08 AM, Shannon Sterz wrote:
> On Wed Apr 22, 2026 at 8:49 AM CEST, Christian Ebner wrote:
>> On 4/21/26 4:45 PM, Manuel Federanko wrote:
>>> Start renewing a certificate once 2/3 of its total lifetime have passed,
>>> instead of the hardcoded 30 days. This stays consistent with many
>>> certificates, which are valid for 90 days.
>>>
>>> The update service runs daily, impose a 3 day minimum remaining lifetime
>>> to still be able to handle transient failures for certificate renewals.
>>>
>>> Signed-off-by: Manuel Federanko <m.federanko@proxmox.com>
>>> Fixes: https://bugzilla.proxmox.com/show_bug.cgi?id=6372
>>> ---
>>
>> @Shannon, can you have a look at this to avoid potential conflicts with
>> your TLS certificate rotation series [0]?
>>
>> [0]
>> https://lore.proxmox.com/pbs-devel/20260407135714.490747-1-s.sterz@proxmox.com/T/#t
> 
> thanks for the heads-up, but from what i can tell not really. this
> series addresses acme certificates, whereas mine is only relevant for
> the self-signed certificates that pbs & pdm fall back on by default. imo
> it would make sense to have these changes expand to include pdm too,
> tho.
Thanks for the input. I will also include this in PDM.
I'm currently working on ARI, so this might change anyways, though I think it is
still valuable until ARI is implemented, also, not all CAs support ARI.