ACME: a renewal that isn't due yet is rescheduled, not failed for good #93

Merged

jcoffey-dev merged 1 commits from fix/acme-not-due-reschedule into main

2026-09-28 21:52:18 +00:00

jcoffey-dev commented

2026-09-28 19:18:02 +00:00

Owner

When a valid certificate already covered a domain's names (one stored by hand before the domain was switched to automatic, say), acme_renew returned NotDue. The task manager treats that as a permanent failure, and nothing rescheduled the renewal, so the certificate later expired unrenewed. This is the trap noted when inbuxa's own domains were switched to Automatic on 2026-09-13.

Now a renewal that isn't due returns a new AcmeRenewal task due at the certificate's renewal point, exactly as a successful renewal does, and logs it as RenewBackoff. The task manager is its only caller. The certificates guide (admin #39) shows this state as already covered, renews on ….

The ACME integration suite gains a check: renewing again right after issuance returns one AcmeRenewal for that domain, due at the certificate's renewal point.

Not run yet. Please run it somewhere Pebble can reach the test server. automation::automation_tests fails on the dev laptop before the new check, at the first issuance, and it fails identically on unchanged main. ufw drops traffic from the stalwart-test-acme docker network (172.21.0.0/16) to the host, so Pebble's TLS-ALPN / HTTP-01 connections to ports 8899/8898 never arrive (confirmed with a container → host probe). To run it locally:

sudo ufw allow in on br-e9f716ec2642 to any port 8898:8899 proto tcp
STORE=RocksDb RUST_MIN_STACK=16777216 cargo test -p tests --lib -- automation::automation_tests --exact --include-ignored

cargo check -p common is clean. CI builds but doesn't run the suite.

When a valid certificate already covered a domain's names (one stored by hand before the domain was switched to automatic, say), `acme_renew` returned `NotDue`. The task manager treats that as a **permanent** failure, and nothing rescheduled the renewal, so the certificate later expired unrenewed. This is the trap noted when inbuxa's own domains were switched to Automatic on 2026-09-13. Now a renewal that isn't due returns a new `AcmeRenewal` task due at the certificate's renewal point, exactly as a successful renewal does, and logs it as `RenewBackoff`. The task manager is its only caller. The certificates guide (admin #39) shows this state as *already covered, renews on …*. The ACME integration suite gains a check: renewing again right after issuance returns one `AcmeRenewal` for that domain, due at the certificate's renewal point. **Not run yet. Please run it somewhere Pebble can reach the test server.** `automation::automation_tests` fails on the dev laptop *before* the new check, at the first issuance, and it fails identically on unchanged main. ufw drops traffic from the `stalwart-test-acme` docker network (172.21.0.0/16) to the host, so Pebble's TLS-ALPN / HTTP-01 connections to ports 8899/8898 never arrive (confirmed with a container → host probe). To run it locally: ``` sudo ufw allow in on br-e9f716ec2642 to any port 8898:8899 proto tcp STORE=RocksDb RUST_MIN_STACK=16777216 cargo test -p tests --lib -- automation::automation_tests --exact --include-ignored ``` `cargo check -p common` is clean. CI builds but doesn't run the suite.

jcoffey-dev added 1 commit 2026-09-28 19:18:02 +00:00

ACME: a renewal that isn't due yet is rescheduled, not failed for good

ci / fork-checks (pull_request) Successful in 14s

Details

ci / build (pull_request) Successful in 16m46s

Details

beb6c33e63

When a valid certificate already covered a domain's names (one stored
by hand before the domain was switched to automatic, for instance), the
renewal task ended with NotDue, which the task manager treats as a
permanent failure. Nothing rescheduled it, so the certificate expired
unrenewed. The renewal now returns a new AcmeRenewal task due when the
certificate falls due, the same way a successful renewal does, and logs
it as a backoff.

The ACME integration suite checks that renewing again right after
issuance hands back one AcmeRenewal for that domain, due at the
certificate's renewal point.

jcoffey-dev merged commit ba75ab4ecc into main

2026-09-28 21:52:18 +00:00

jcoffey-dev deleted branch fix/acme-not-due-reschedule

2026-09-28 21:52:18 +00:00

jcoffey-dev referenced this pull request

2026-09-28 22:29:14 +00:00

DNS test: expect the account-configuration digest inbuxa publishes #96

jcoffey-dev referenced this pull request

2026-09-28 23:57:55 +00:00

Release 2026.9.28.5 #98