[PATCH pve-manager v2 2/2] fix #8006: api: acme: lifetime-based certificate renewal threshold

[David Riley <d.riley@proxmox.com>]

Replace the hardcoded 30-day renewal limit with a threshold based on
the certificate's actual lifetime.

The previous hardcoded limit caused excessive daily renewals for
short-lived certificates (e.g., 31 days). This change ensures they
renew at sensible intervals, avoiding upstream rate limits.

Link: https://bugzilla.proxmox.com/show_bug.cgi?id=8006

Signed-off-by: David Riley <d.riley@proxmox.com>
---
 PVE/API2/ACME.pm | 10 ++++++----
 bin/pveupdate    |  4 +++-
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/PVE/API2/ACME.pm b/PVE/API2/ACME.pm
index a948a72a..21ed3878 100644
--- a/PVE/API2/ACME.pm
+++ b/PVE/API2/ACME.pm
@@ -243,7 +243,8 @@ __PACKAGE__->register_method({
             node => get_standard_option('pve-node'),
             force => {
                 type => 'boolean',
-                description => 'Force renewal even if expiry is more than 30 days away.',
+                description =>
+                    'Force renewal even if the certificate is not yet due for renewal.',
                 optional => 1,
                 default => 0,
             },
@@ -261,12 +262,13 @@ __PACKAGE__->register_method({
         raise("No current (custom) certificate found, please order a new certificate!\n")
             if !-e "${cert_prefix}.pem";
 
+        my $lead_time = PVE::Certificate::get_cert_renew_lead_time("${cert_prefix}.pem");
+
         my $expires_soon =
-            PVE::Certificate::check_expiry("${cert_prefix}.pem", time() + 30 * 24 * 60 * 60);
+            PVE::Certificate::check_expiry("${cert_prefix}.pem", time() + $lead_time);
         raise_param_exc(
             {
-                'force' =>
-                    "Certificate does not expire within the next 30 days, and 'force' is not set.",
+                'force' => "Certificate is not yet due for renewal, and 'force' is not set.",
             },
         ) if !$expires_soon && !$param->{force};
 
diff --git a/bin/pveupdate b/bin/pveupdate
index b1960c35..a014d1d3 100755
--- a/bin/pveupdate
+++ b/bin/pveupdate
@@ -83,7 +83,9 @@ eval {
     if ($acme_node_config && $acme_node_config->{domains}) {
         my $cert = PVE::CertHelpers::cert_path_prefix($nodename) . ".pem";
         if (-e $cert) {
-            if (PVE::Certificate::check_expiry($cert, time() + 30 * 24 * 60 * 60)) {
+            my $lead_time = PVE::Certificate::get_cert_renew_lead_time($cert);
+
+            if (PVE::Certificate::check_expiry($cert, time() + $lead_time)) {
                 PVE::API2::ACME->renew_certificate({ node => $nodename });
             } else {
                 syslog(
-- 
2.47.3