Le jeudi 8 octobre 2026, 17:39:52 heure d’été d’Europe centrale Marc SCHAEFER a écrit : > Hello, > > If I understand well, the certbot in bookworm LTS is version 2, which does not > support ARI (dynamic windows to resist to mass revocations). Even trixie > certbot is not 4.1+. > > Even on bookworm, as certbot is started twice a day, and > > /etc/letsencrypt/renewal/XXX.ch.conf:# renew_before_expiry = 30 days > > it should work no problem in 2027 (64 days certificate lifetime, > reissuing recommended at 2/3 of certificate life) or even 2028 > (45 days, 2/3 is just 30 days). > > Do you agree with this analysis?
I thinks this should be discussed first with security team for first fixing trixie than if possible do a backport to LTS. We have a few month to get a solution but it should be made in correct order to avoid regression on upgrade. Rouca > > Have a nice day/evening. > > Reference: > https://letsencrypt.org/2025/12/02/from-90-to-45 > >
signature.asc
Description: This is a digitally signed message part.
