On 2026/10/18 21:42, Lloyd wrote:
> Given a configuration as follows:
>
> domain 1.2.3.4 {
> alternative names { 1.2.3.4 }
> ...
> }
>
> this will pass acme-client -n validation
>
> However running acme-client will always force a renewal:
>
> acme-client: /etc/ssl/foo.crt: certificate valid: 5 days left
> acme-client: /etc/ssl/foo.crt: domain list changed, forcing renewal
>
> The renewal is forced because the 'force' flag is set to '2' at
> some point during the internal checks of the data structures.
>
> I believe there is a bug either in the config or the validation.
>
> If this is an invalid config, it should be rejected by the parser.
I think it's kind-of an invalid config, though not tricky to
unambiguously do the right thing with so maybe we should do that.
These would be similar:
domain foo.example {
alternative names { foo.example }
...
}
domain 1.2.3.4 {
alternative names { foo.example }
alternative names { foo.example }
...
}
