Renewing certificates at 15 day instead of 30 day mark. AKA: How can I handle 30 day certificates?

[jamesharr]

Hi, We're using certbot against Sectigo's ACME service successfully. We recently switched to 30 day certificates to get ahead of the curve. We can successfully renew certificates just fine via cron jobs, but we've noticed that certbot has been renewing certificates daily. In a world of 90 day certificates, setting the renewal day to 30 makes sense, but we're nearing a world where 30 day certificates might be closer to the norm.

So my question:

1. Is there a configuration option OR CLI flag to adjust the number of days certbot will consider a certificate "valid". IE: We'd like to look at 15 days instead of 30.
2. It might also be worth considering looking at a valid timespan based on the certificate's original timespan. IE: Plan on renewing a certificate when it has 1/3 of its valid span left or 30 days (which ever is shorter). This would allow certbot to automatically adjust for shorter certificates.

We're currently using certbot 2.11.0. If I've missed mention of such a feature in the docs, I apologize.

[danb35]

@jamesharr

We're currently using certbot 2.11.0.

Current is, IIRC, 3.10.

I don't know if there's a CLI flag for this, but you can set the renew_before_expiry option in your renewal config file (/etc/letsencrypt/renewal/yourdomain.conf).

@jamesharr

Plan on renewing a certificate when it has 1/3 of its valid span left

Caddy does this, but I'm not aware of any other client that does.

[petercooperjr]

You're looking for "renew_before_expiry" in the configuration file. Though I agree that the docs don't really cover it.

[jamesharr]

Thanks @danb35 and @petercooperjr

I might raise an issue in the certbot to document this.

[petercooperjr]

They've had an issue open for a few years about having certbot handle shorter-duration certificates better. So I think they know they need to do something, but they're taking their time on it.

Change renewal interval to better support certificates valid for less than 90 days

Certbot is good for what its intention is, of just adding to a standalone server to get it enabled for HTTPS. But if you're looking for more than that, there are a lot of value in other clients that are designed for more advanced and enterprise use cases.

[Osiris]

@petercooperjr

So I think they know they need to do something, but they're taking their time on it.

Change renewal interval to better support certificates valid for less than 90 days · Issue #9261 · certbot/certbot · GitHub

Unfortunately, the Certbot team is rather small and doesn't have much time for the project Although it's kinda weird the issue was opened almost 3 years ago and these kind of 'breaking changes' (e.g., just use some min(30, max(1, lifetime / 3)) math) could "easily" have been included in the major release 3.0.0 methinks..