applied: [PATCH proxmox-backup v2] acme: partially fix #6372: scale certificate renewal checks by lifetime

[Thomas Lamprecht <t.lamprecht@proxmox.com>]

On Thu, 23 Apr 2026 15:46:08 +0200, Manuel Federanko wrote:
> Start renewing a certificate once 2/3 or 1/2 (for short-lived
> certificates) of its total lifetime have passed, instead of the
> hardcoded 30 days. This stays consistent with many certificates, which
> are valid for 90 days and is recommended by letsencrypt [1].
> 
> The update service runs daily, impose a 3 day minimum remaining lifetime
> to still be able to handle transient failures for certificate renewals.
> 
> [...]

Just again for the record: v1 was already applied when v2 landed, to avoid
dropping v2, I pulled its improvements in as follow-ups on top of v1, so
this should be basically (semantically) applied now too.

Follow-ups on top of v1 I pushed:

- 3ee7129c6 acme: certificates: update stale 30-day doc comments
- 034652107 acme: certificates: warn on fallback to 30-day renewal lead time
- cec290d10 acme: certificates: parse certificate once per renewal check
- 3d819b132 acme: certificates: factor out SECONDS_PER_DAY constant

Ported from v2:

- 74bc33071 acme: certificates: use 1/2 lifetime lead for short-lived certs

I kept the 3-day floor inside cert_renew_lead_time rather than moving it to
the daily-update caller as you did - behavior is equivalent for every
lifetime, and it keeps the policy in one place with fewer cert reads per
cycle.

For the PDM port: the same improvements apply there too. One option would be
to add a renewal_lead_time(&self) -> i64 helper on CertificateInfo in
proxmox-acme-api::certificate_helpers, use it from PDM, and then switch PBS
over to it here as well - single source of truth for both products.