Re: [PATCH common/manager 0/2] fix #8006: acme: lifetime-based certificate renewal threshold

[David Riley <d.riley@proxmox.com>]

On 10/16/26 2:45 PM, Michael Köppl wrote:
> Tested this a bit using faketime to force certificate renewals. Noticed
> the following:
> - Could create a scenario where an expired short-lived cert would be
>    served because of the missing 3-day floor present in PBS: with a 48h
>    cert, the renewal window is 24h. With the clock moved to 23h after the
>    cert was issued (25h left), renewal is refused with "does not expire
>    within the next 1 days". At 49h after the cert was issued (1h after
>    it expired), renew is no longer refused. The 2 attempts arre 26h
>    apart, which is within the randomized time frame for pve-daily-update
>    runs (01:00 + up to 5h delay), so it can happen that no run lands
>    inside the window. The expired cert is then served until the next run
>    renews it.
> - The pveupdate script still uses the hard-coded 30 days, so creating a
>    certificate with 25 days left, it will attempt to renew, but the API
>    will refuse.
> Added comments for the above on the individual patches.
>
> For longer-lived certs as describes in the cover letter, this worked as
> expected, though. I really like this as an improvement to PVE.


Thanks for taking the time to do a thorough review and testing it and pointing
out the edge cases that currently exist.
Seems like I have missed a couple of essential parts, I will address them in a v2.

>
> On Tue Oct 6, 2026 at 2:31 PM CEST, David Riley wrote:
>> This patch series addresses an issue where short-lived ACME
>> certificates (e.g., 31-day validity) trigger daily renewal attempts
>> due to PVE's hardcoded 30-day threshold.
>>
>> Because PVE currently relies on non-ARI renewal logic, these daily
>> attempts quickly exhaust upstream rate limits. With Let's Encrypt,
> [snip]
>
>
>
>