ACME: order a certificate when a domain's names change #295

Merged

jcoffey-dev merged 1 commits from fix/acme-renew-on-names-290 into main

2026-11-06 06:39:58 +00:00

Author	SHA1	Message	Date
jcoffey-dev	69125b325d	ACME: order a certificate when a domain's names change ci / fork-checks (pull_request) Skipped Details ci / build (pull_request) Skipped Details github/ci (branch) GitHub Actions Details ci / github (pull_request) Successful in 10m46s Details Editing Additional Hostnames on a domain already on ACME saved fine and ordered nothing, so the new names waited for the next renewal, about 60 days on a 90-day certificate. Saving now queues an order when the names, the provider or the domain name change. A certificate that already has those exact names just waits for its renewal date, so reordering the list orders nothing. Each renewal queues the next, so a second task would be a second chain of renewals for good, and on a cluster both could order at once. A new renewal now replaces the domain's queued one. CAA and the DNS-PERSIST-01 record name the provider, and the persist record says whether wildcards are allowed. When a save makes them out of date they're published before the order, or the CA refuses it. A DNS task that renews afterwards may now have an empty record list, which publishes just the persist record. Fixes #290	2026-11-05 08:57:42 -07:00

Author

SHA1

Message

Date

jcoffey-dev

69125b325d

ACME: order a certificate when a domain's names change

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 10m46s

Details

Editing Additional Hostnames on a domain already on ACME saved fine and
ordered nothing, so the new names waited for the next renewal, about 60
days on a 90-day certificate. Saving now queues an order when the names,
the provider or the domain name change. A certificate that already has
those exact names just waits for its renewal date, so reordering the list
orders nothing.

Each renewal queues the next, so a second task would be a second chain of
renewals for good, and on a cluster both could order at once. A new
renewal now replaces the domain's queued one.

CAA and the DNS-PERSIST-01 record name the provider, and the persist
record says whether wildcards are allowed. When a save makes them out of
date they're published before the order, or the CA refuses it. A DNS task
that renews afterwards may now have an empty record list, which publishes
just the persist record.

Fixes #290

2026-11-05 08:57:42 -07:00