From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id C4C0F1FF0B7 for ; Fri, 16 Oct 2026 14:45:25 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 82688214E4; Fri, 16 Oct 2026 14:45:24 +0200 (CEST) Content-Type: text/plain; charset=UTF-8 Date: Fri, 16 Oct 2026 14:45:20 +0200 Message-Id: From: =?utf-8?q?Michael_K=C3=B6ppl?= To: "David Riley" , Subject: Re: [PATCH pve-common 1/2] certificate: add helpers for lifetime-based ACME renewal Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 X-Mailer: aerc 0.22.0 References: <20261006123120.68750-1-d.riley@proxmox.com> <20261006123120.68750-2-d.riley@proxmox.com> In-Reply-To: <20261006123120.68750-2-d.riley@proxmox.com> X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1792154720307 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.248 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: BVI3B4LRPOQNAS2MNUZIB7PVU6MZKKOF X-Message-ID-Hash: BVI3B4LRPOQNAS2MNUZIB7PVU6MZKKOF X-MailFrom: m.koeppl@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Tue Oct 6, 2026 at 2:31 PM CEST, David Riley wrote: [snip] > +sub get_cert_renew_lead_time { > + my ($cert_path) =3D @_; > + > + my $default_lead =3D 30 * 24 * 60 * 60; > + > + my $not_before =3D get_not_before_as_epoch($cert_path); > + my $not_after =3D get_expiration_as_epoch($cert_path); > + > + my $lifetime =3D $not_after - $not_before; > + return $default_lead if $lifetime <=3D 0; > + > + my $scale =3D $lifetime < (10 * 24 * 60 * 60) ? 2 : 3; > + > + return int($lifetime / $scale); The scaling mirrors what's done in PBS, but shouldn't this also have the 3-day floor that PBS has? AFAICT from the original series, the this floor was applied as it was in v1, so as part of the helper function, so it should probably also go here. If I understand Shannon's comment [0] on the original series correctly, for short-lived certificates (e.g. 48h) the renewal window (in this case 24h) might be shorter than the time between pveupdate runs and renewal might fail because of that. I'm able to reproduce this using `faketime`. Or is there a reason this was ommitted? [0] https://lore.proxmox.com/pbs-devel/DHZKEJBTPLZY.TNSL8CWILFKT@proxmox.co= m/ > +} > + > # Create a CSR and certificate key for a given order > # returns path to CSR file or path to CSR and key files > sub generate_csr {