Re: [PATCH pve-common 1/2] certificate: add helpers for lifetime-based ACME renewal

["Michael Köppl" <m.koeppl@proxmox.com>]

On Tue Oct 6, 2026 at 2:31 PM CEST, David Riley wrote:

[snip]

> +sub get_cert_renew_lead_time {
> +    my ($cert_path) = @_;
> +
> +    my $default_lead = 30 * 24 * 60 * 60;
> +
> +    my $not_before = get_not_before_as_epoch($cert_path);
> +    my $not_after = get_expiration_as_epoch($cert_path);
> +
> +    my $lifetime = $not_after - $not_before;
> +    return $default_lead if $lifetime <= 0;
> +
> +    my $scale = $lifetime < (10 * 24 * 60 * 60) ? 2 : 3;
> +
> +    return int($lifetime / $scale);

The scaling mirrors what's done in PBS, but shouldn't this also have
the 3-day floor that PBS has? AFAICT from the original series, the this
floor was applied as it was in v1, so as part of the helper function, so
it should probably also go here.

If I understand Shannon's comment [0] on the original series correctly,
for short-lived certificates (e.g. 48h) the renewal window (in this case
24h) might be shorter than the time between pveupdate runs and renewal
might fail because of that. I'm able to reproduce this using `faketime`.

Or is there a reason this was ommitted?

[0] https://lore.proxmox.com/pbs-devel/DHZKEJBTPLZY.TNSL8CWILFKT@proxmox.com/

> +}
> +
>  # Create a CSR and certificate key for a given order
>  # returns path to CSR file or path to CSR and key files
>  sub generate_csr {