Hi, (adding #1142589, since it's related)
El 13/10/26 a las 21:01, Bastien Roucaries escribió: > Le jeudi 8 octobre 2026, 17:39:52 heure d’été d’Europe centrale Marc SCHAEFER > a écrit : > > Hello, > > > > If I understand well, the certbot in bookworm LTS is version 2, which does > > not > > support ARI (dynamic windows to resist to mass revocations). Even trixie > > certbot is not 4.1+. > > > > Even on bookworm, as certbot is started twice a day, and > > > > /etc/letsencrypt/renewal/XXX.ch.conf:# renew_before_expiry = 30 days > > > > it should work no problem in 2027 (64 days certificate lifetime, > > reissuing recommended at 2/3 of certificate life) or even 2028 > > (45 days, 2/3 is just 30 days). > > > > Do you agree with this analysis? > > I thinks this should be discussed first with security team for first fixing > trixie than if possible do a backport to LTS. I do agree that this should be first discussed for and tackled in trixie. Since this doesn't seem related to a vulnerability, I think trixie is mostly on the certbot maintainer domain. Harlan, any thoughts? > > We have a few month to get a solution but it should be made in correct order > to avoid regression on upgrade. > > Rouca > > > > Have a nice day/evening. > > > > Reference: > > https://letsencrypt.org/2025/12/02/from-90-to-45 Cheers, -- Santiago Ruano Rincón ◈ Freexian SARL https://www.freexian.com
signature.asc
Description: PGP signature
