[pve-devel] [PATCH docs] fix #5665: add note about short-lived cert renewal

[pve-devel] [PATCH docs] fix #5665: add note about short-lived cert renewal

[Fabian Grünbichler]

not that obvious behaviour on the systemd side, and missing cert renewal can
have wide-reaching consequences.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
---
 certificate-management.adoc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/certificate-management.adoc b/certificate-management.adoc
index 71c6d71..3bb9bb9 100644
--- a/certificate-management.adoc
+++ b/certificate-management.adoc
@@ -223,6 +223,9 @@ If a node has been successfully configured with an ACME-provided certificate
 renewed by the `pve-daily-update.service`. Currently, renewal will be attempted
 if the certificate has expired already, or will expire in the next 30 days.
 
+NOTE: If you are using a custom directory that issues short-lived certificates,
+disabling the random delay for the `pve-daily-update.timer` unit might be
+advisable to avoid missing a certificate renewal after a reboot.
 
 ACME Examples with `pvenode`
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-- 
2.39.2



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

[pve-devel] applied: [PATCH docs] fix #5665: add note about short-lived cert renewal

[Fiona Ebner]

Am 09.09.24 um 14:39 schrieb Fabian Grünbichler:
> not that obvious behaviour on the systemd side, and missing cert renewal can
> have wide-reaching consequences.
> 
> Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
> ---
>  certificate-management.adoc | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/certificate-management.adoc b/certificate-management.adoc
> index 71c6d71..3bb9bb9 100644
> --- a/certificate-management.adoc
> +++ b/certificate-management.adoc
> @@ -223,6 +223,9 @@ If a node has been successfully configured with an ACME-provided certificate
>  renewed by the `pve-daily-update.service`. Currently, renewal will be attempted
>  if the certificate has expired already, or will expire in the next 30 days.
>  
> +NOTE: If you are using a custom directory that issues short-lived certificates,
> +disabling the random delay for the `pve-daily-update.timer` unit might be
> +advisable to avoid missing a certificate renewal after a reboot.
>  
>  ACME Examples with `pvenode`
>  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~

applied, thanks!


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel