From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 61D911FF0B7 for ; Fri, 16 Oct 2026 15:17:44 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 6B51C214CA; Fri, 16 Oct 2026 15:17:40 +0200 (CEST) Message-ID: <3a8341b3-452c-4f12-b1e4-f2d7b8615b42@proxmox.com> Date: Fri, 16 Oct 2026 15:17:33 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH pve-common 1/2] certificate: add helpers for lifetime-based ACME renewal To: =?UTF-8?Q?Michael_K=C3=B6ppl?= , pve-devel@lists.proxmox.com References: <20261006123120.68750-1-d.riley@proxmox.com> <20261006123120.68750-2-d.riley@proxmox.com> Content-Language: en-US From: David Riley In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1792156653911 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.735 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: NI25PPBOSER6R2A4HDM55CHIV7BU7J7P X-Message-ID-Hash: NI25PPBOSER6R2A4HDM55CHIV7BU7J7P X-MailFrom: d.riley@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On 10/16/26 2:45 PM, Michael Köppl wrote: > On Tue Oct 6, 2026 at 2:31 PM CEST, David Riley wrote: > > [snip] > >> +sub get_cert_renew_lead_time { >> + my ($cert_path) = @_; >> + >> + my $default_lead = 30 * 24 * 60 * 60; >> + >> + my $not_before = get_not_before_as_epoch($cert_path); >> + my $not_after = get_expiration_as_epoch($cert_path); >> + >> + my $lifetime = $not_after - $not_before; >> + return $default_lead if $lifetime <= 0; >> + >> + my $scale = $lifetime < (10 * 24 * 60 * 60) ? 2 : 3; >> + >> + return int($lifetime / $scale); > The scaling mirrors what's done in PBS, but shouldn't this also have > the 3-day floor that PBS has? AFAICT from the original series, the this > floor was applied as it was in v1, so as part of the helper function, so > it should probably also go here. > > If I understand Shannon's comment [0] on the original series correctly, > for short-lived certificates (e.g. 48h) the renewal window (in this case > 24h) might be shorter than the time between pveupdate runs and renewal > might fail because of that. I'm able to reproduce this using `faketime`. > > Or is there a reason this was ommitted? > > [0] https://lore.proxmox.com/pbs-devel/DHZKEJBTPLZY.TNSL8CWILFKT@proxmox.com/ > You are right this should have definitely be included here as well. Seems like I have missed that part when looking at the pbs series. Thanks for the heads up, I will correct that in a v2. >> +} >> + >> # Create a CSR and certificate key for a given order >> # returns path to CSR file or path to CSR and key files >> sub generate_csr { > > > > >