-
Notifications
You must be signed in to change notification settings - Fork 42
Description
When using --no-ari, an unnecessary acme_bootstrap (fetch "directory" info from CA) is performed when the certificate is not yet ready for renewal. When --no-ari is used, the certificate expiration date is read directly and compared against the certificate re-issue value specified in --days (or 30 days by default) rather than checking the CA's renewalInfo return value.
The code in uacme.c currently performs acme_bootstrap() always, which creates an unnecessary directory request to the CA if the certificate is "still valid" (not yet ready for reissue) when --no-ari is used.
The patch below (against tag 1.7.6) delays the call to acme_bootstrap() until the certificate reissue is required if --no-ari is used (otherwise, it correctly behaves as it currently does).