Re: [PATCH common/manager 0/2] fix #8006: acme: lifetime-based certificate renewal threshold

["Michael Köppl" <m.koeppl@proxmox.com>]

Tested this a bit using faketime to force certificate renewals. Noticed
the following:
- Could create a scenario where an expired short-lived cert would be
  served because of the missing 3-day floor present in PBS: with a 48h
  cert, the renewal window is 24h. With the clock moved to 23h after the
  cert was issued (25h left), renewal is refused with "does not expire
  within the next 1 days". At 49h after the cert was issued (1h after
  it expired), renew is no longer refused. The 2 attempts arre 26h
  apart, which is within the randomized time frame for pve-daily-update
  runs (01:00 + up to 5h delay), so it can happen that no run lands
  inside the window. The expired cert is then served until the next run
  renews it.
- The pveupdate script still uses the hard-coded 30 days, so creating a
  certificate with 25 days left, it will attempt to renew, but the API
  will refuse.
Added comments for the above on the individual patches.

For longer-lived certs as describes in the cover letter, this worked as
expected, though. I really like this as an improvement to PVE.

On Tue Oct 6, 2026 at 2:31 PM CEST, David Riley wrote:
> This patch series addresses an issue where short-lived ACME
> certificates (e.g., 31-day validity) trigger daily renewal attempts
> due to PVE's hardcoded 30-day threshold.
>
> Because PVE currently relies on non-ARI renewal logic, these daily
> attempts quickly exhaust upstream rate limits. With Let's Encrypt,

[snip]