Re: [PATCH proxmox-backup] acme: partially fix #6372: scale certificate renewal checks by lifetime

["Shannon Sterz" <s.sterz@proxmox.com>]

On Wed Apr 22, 2026 at 8:49 AM CEST, Christian Ebner wrote:
> On 4/21/26 4:45 PM, Manuel Federanko wrote:
>> Start renewing a certificate once 2/3 of its total lifetime have passed,
>> instead of the hardcoded 30 days. This stays consistent with many
>> certificates, which are valid for 90 days.
>>
>> The update service runs daily, impose a 3 day minimum remaining lifetime
>> to still be able to handle transient failures for certificate renewals.
>>
>> Signed-off-by: Manuel Federanko <m.federanko@proxmox.com>
>> Fixes: https://bugzilla.proxmox.com/show_bug.cgi?id=6372
>> ---
>
> @Shannon, can you have a look at this to avoid potential conflicts with
> your TLS certificate rotation series [0]?
>
> [0]
> https://lore.proxmox.com/pbs-devel/20260407135714.490747-1-s.sterz@proxmox.com/T/#t

thanks for the heads-up, but from what i can tell not really. this
series addresses acme certificates, whereas mine is only relevant for
the self-signed certificates that pbs & pdm fall back on by default. imo
it would make sense to have these changes expand to include pdm too,
tho.