Skip to content

unnecessary acme_bootstrap sometimes performed to CA when using --no-ari #104

@gkloepfer

Description

@gkloepfer

When using --no-ari, an unnecessary acme_bootstrap (fetch "directory" info from CA) is performed when the certificate is not yet ready for renewal. When --no-ari is used, the certificate expiration date is read directly and compared against the certificate re-issue value specified in --days (or 30 days by default) rather than checking the CA's renewalInfo return value.

The code in uacme.c currently performs acme_bootstrap() always, which creates an unnecessary directory request to the CA if the certificate is "still valid" (not yet ready for reissue) when --no-ari is used.

The patch below (against tag 1.7.6) delays the call to acme_bootstrap() until the certificate reissue is required if --no-ari is used (otherwise, it correctly behaves as it currently does).

1.7.6-delay-bootstrap-no-ari-check.patch

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions