Using certbot 4.0.0 on devuan (debian derivative).
My established process for many certificates is all working fine and has been for some time. Certbot runs as a daily cron job to check for renewals: "certbot -q renew"
I've recently changed one of my domains from the standard 90 day to be 'shortlived' (7 day). That renewed successfully the first time but then seemed to renew every day so that the certificate life was only ever 7 or 6 days, it never got any lower. I'm now on the sixth(?) day of this and so have just hit the rate limit as:
"Up to 5 certificates can be issued per exact same set of identifiers every 7 days."
It seems that certbot is seeing the certificate has 6 days left and trying to renew it every day. Which is a bit keen for a 7 day certificate.
Am I doing something wrong with the 'shortlived' approach? (I appreciate this is probably more a certbot issue than a letsencrypt issue but wondered if others have come across the same.)
Thanks. That changelog entry looks like the key one. I've upgraded to certbot 5.5.0 (from debian/devuan testing - I would prefer not to have a mixed system but this feels necessary) so I'll monitor how often it refreshes over the coming days.
The certbot team recommends installing through their snap package (or setting up a python environment through pip) rather than using an OS's package manager to install it, since generally it's useful to update it more often than most OS package managers do so. There are certainly downsides to that too (and is one reason I don't generally use certbot myself); I'm just letting you know what they recommend.
You may also want to confirm there isn't a renew_before_expiry line or something like it in your renewal configuration file; that can tell certbot to renew just a certain number of days before a certificate expiry instead of the now-default logic that also takes the certificate lifetime into account. Sometimes people have configured it and forgotten that they did so, and it wouldn't shock me if some certbot upgrade paths left an old value in there.
I checked the renewal conf file. I didn't have a renew_before_expiry type entry. But I see since the update (as part of it's first cron run) certbot has added:
Which wasn't there before (under 4.0.0). So that gives me hope that this is the missing link and certbot will now wait for the appropriate time before renewing the shortlived certificate.