Re: [PATCH pve-manager 2/2] fix #8006: api: acme: lifetime-based certificate renewal threshold

[David Riley <d.riley@proxmox.com>]

On 10/16/26 2:45 PM, Michael Köppl wrote:
> On Tue Oct 6, 2026 at 2:31 PM CEST, David Riley wrote:
>> Replace the hardcoded 30-day renewal limit with a threshold based on
>> the certificate's actual lifetime.
>>
>> The previous hardcoded limit caused excessive daily renewals for
>> short-lived certificates (e.g., 31 days). This change ensures they
>> renew at sensible intervals, avoiding upstream rate limits.
>>
>> Link: https://bugzilla.proxmox.com/show_bug.cgi?id=8006
>>
>> Signed-off-by: David Riley <d.riley@proxmox.com>
>> ---
>>   PVE/API2/ACME.pm | 7 +++++--
>>   1 file changed, 5 insertions(+), 2 deletions(-)
>>
>> diff --git a/PVE/API2/ACME.pm b/PVE/API2/ACME.pm
>> index a948a72a..4f2590f0 100644
>> --- a/PVE/API2/ACME.pm
>> +++ b/PVE/API2/ACME.pm
>> @@ -261,12 +261,15 @@ __PACKAGE__->register_method({
>>           raise("No current (custom) certificate found, please order a new certificate!\n")
>>               if !-e "${cert_prefix}.pem";
>>
>> +        my $lead_time = PVE::Certificate::get_cert_renew_lead_time("${cert_prefix}.pem");
>> +        my $lead_days = int($lead_time / (24 * 60 * 60));
>> +
>>           my $expires_soon =
>> -            PVE::Certificate::check_expiry("${cert_prefix}.pem", time() + 30 * 24 * 60 * 60);
>> +            PVE::Certificate::check_expiry("${cert_prefix}.pem", time() + $lead_time);
> Should this perhaps also be done for bin/pveupdate? It still uses the
> hard-coded 30 days and the PBS patch you're referring to in the cover
> letter also updates its daily job.


Missed that thanks. Will update this and the force parameter description in v2.


>>           raise_param_exc(
>>               {
>>                   'force' =>
>> -                    "Certificate does not expire within the next 30 days, and 'force' is not set.",
>> +                    "Certificate does not expire within the next $lead_days days, and 'force' is not set.",
> This should also be done for the description of the 'force' param. It
> still reads "... is more than 30 days away".
>
>>               },
>>           ) if !$expires_soon && !$param->{force};
>>
>
>
>
>
>