[PATCH common/manager v2 0/2] fix #8006: acme: lifetime-based certificate renewal threshold

[David Riley <d.riley@proxmox.com>]

Thanks Michael K. for taking a look.

Differences from v1:
* Refactor: Reduce certificate reads by combining the read of
  notBefore and notAfter.
* Add: Warning users of certificates with lifetime <= 0
* Add: minimum lead time of 3 days
* Update 'force' parameter description in API schema
* Add: dynamic lead time calculation to bin/pveupdate

Note on short-lived certificates:
Because pveupdate runs daily and there is a 3-day minimum lead time,
short-lived certificates (e.g., 24h, 48h) will get renewed every day
and therefore might be limited by upstream rate limiting.
Supporting such short-lived certificates safely will require both
implementing ARI [3] and adjusting the renewal check frequency.

Dependencies:
pve-manager requires a versioned dependency bump on libpve-common-perl
for the new helper.

---
Original Cover Letter:

This patch series addresses an issue where short-lived ACME
certificates (e.g., 31-day validity) trigger daily renewal attempts
due to PVE's hardcoded 30-day threshold.

Because PVE currently relies on non-ARI renewal logic, these daily
attempts quickly exhaust upstream rate limits. With Let's Encrypt,
for example, this would hit their duplicate certificate limit
(5 renewals per exact set of identifiers per 7 days) [0], resulting
in blocked issuances.

To prevent hitting these upstream limits, the static threshold is 
replaced with a dynamic one based on the certificate's actual
lifetime (notAfter - notBefore) [1]. The scaling mirrors the logic
already present in Proxmox Backup Server [2].

This is intended as a stop-gap measure to gracefully handle the
shift toward shorter-lived certificates until the full ACME Renewal
Information (ARI) [3] flow is implemented.

Link: https://bugzilla.proxmox.com/show_bug.cgi?id=8006

[0] https://letsencrypt.org/docs/rate-limits/#new-certificates-per-exact-set-of-identifiers
[1] https://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt
[2] https://lore.proxmox.com/pbs-devel/20260423134607.105229-2-m.federanko@proxmox.com/
[3] https://www.rfc-editor.org/rfc/rfc9773.html


pve-common:

David Riley (1):
  certificate: add helpers for lifetime-based ACME renewal

 src/PVE/Certificate.pm | 39 +++++++++++++++++++++++++++++++++++++--
 1 file changed, 37 insertions(+), 2 deletions(-)


pve-manager:

David Riley (1):
  fix #8006: api: acme: lifetime-based certificate renewal threshold

 PVE/API2/ACME.pm | 10 ++++++----
 bin/pveupdate    |  4 +++-
 2 files changed, 9 insertions(+), 5 deletions(-)


Summary over all repositories:
  3 files changed, 46 insertions(+), 7 deletions(-)

-- 
Generated by murpp 0.11.0