ARI recommendation may cause renewal outside Suggested Window

mholt · March 13, 2025, 4:26pm

A while ago I opened an issue with a similar concern:

Recommended algorithm may lead to renewals outside of suggested window

opened 08:15PM - 03 May 24 UTC

closed 10:23PM - 03 May 24 UTC

Maybe this is OK, since the window is only a suggestion, but I noticed that this… algorithm in section 4.2: > 1. Select a uniform random time within the suggested window. > 2. If the selected time is in the past, attempt renewal immediately. > 3. Otherwise, if the client can schedule itself to attempt renewal at exactly the selected time, do so. > 4. Otherwise, if the selected time is before the next time that the client would wake up normally, attempt renewal immediately. > 5. Otherwise, sleep until the next normal wake time, re-check ARI, and return to Step 1. can result in clients renewing before the renewal window. Let's say the client wakes up once every 24 hours (that's very infrequent, but for the purposes of this discussion let's go with this). It wakes up 23 hours before the start of the renewal window, and 23.1 hours before the selected time (it happened to be toward the very beginning of the window). Step 2 is out because it's in the future. Let's say step 3 is out too, since it can't schedule itself. Step 4 then says to perform renewal immediately, which is still 23 hours before the renewal window even starts. Is that acceptable? Or should the client wait until it's in the renewal window (but then miss the selected time, albeit just a little bit in this case)? My code so far looks something like `cutoff := cert.ari.SelectedTime.Add(-cfg.certCache.options.RenewCheckInterval)`. So, of course, if `cert.ari.SelectedTime` is near the beginning of the window, and `cfg.certCache.options.RenewCheckInterval` is any amount large, the resulting `cutoff` is likely to be before the start of the window. You know I'm in favor of earlier renewals :slightly_smiling_face: , but I did want to seek clarification on this.

The answer being:

Yes, the situation you describe is acceptable -- if it wasn't, I wouldn't have specified it.

Topic		Replies	Views
Client Burden of Preemptive ARI Timing Selection Client dev	20	506	July 29, 2025
Can ARI-conforming clients be granted exemptions to relevant rate limits? Client dev	47	2721	May 11, 2023
Thoughts from starting to play with ARI Client dev	135	5223	February 16, 2025
What are you doing with ARI Retry-After? Client dev	28	619	March 6, 2025
API to get suggested renewal time Feature Requests	16	1210	July 29, 2018

ARI recommendation may cause renewal outside Suggested Window

Related topics