Certificate lifecycle: force-renew a single name #41
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Deferred from the per-name ACME work (spec:
obsidian/Personal/Projects/edge-router/specs/2026-10-22-remove-tpm-openbao-encryption-design.md).An operator-triggered renewal for one name, outside the reconciler's 30-day schedule.
Why it waits: it interacts with Let's Encrypt's duplicate-certificate limit — 5 per exact set of identifiers per 7 days, with no overrides and renewals counting against it. A force-renew endpoint is a way to exhaust that budget by hand, so it needs a guard (a cooldown, or a refusal when the remaining duplicate budget is unknown) rather than being a thin wrapper over the order path. That design is not needed to ship the removal work.
Prerequisite: the per-name certificate table and reconciler from the spec above.