search

aarongable / draft-acme-ari

Internet Draft for the Automated Certificate Management Environment (ACME) Renewal Information (ARI) Extension
Other
3 stars 7 forks source link

Clarification of Retry-After, wake times, and polling intervals #70

Closed mholt closed 2 months ago

mholt commented 2 months ago

Draft 3 says:

The following algorithm is RECOMMENDED for choosing a renewal time:

  1. Select a uniform random time within the suggested window. ...
  2. Otherwise, sleep until the next normal wake time, re-check ARI, and return to Step 1.

(Step "2." above is actually step 5, I dunno why it shows up as 2, I definitely wrote 5)

Anyway, if step 5 is reached, it says to wait until the next waking time, and then "re-check ARI." What does this mean exactly? Poll the endpoint to get the updated info, or to use the previously-polled window that is stored in a cache of some sort? If it is the former, wouldn't we only poll with respect to Retry-After (if set)?

Then, when returning to step 1, we are supposed to choose a new random time within the window. Is that intended? Or is the intention that we choose just 1 random time in the window, then store that (until the window changes) and reuse it, checking against that time when running the algorithm? I guess generating a random time each waking is no more and no less random than choosing 1 random time and reusing it until the window changes.

Thanks, hoping to gain some clarity on these things.

aarongable commented 2 months ago

(Step "2." above is actually step 5, I dunno why it shows up as 2, I definitely wrote 5)

Yeah, that's just markdown being markdown.

What does this mean exactly?

This is a good point. It seems intuitively obvious -- query the ARI endpoint -- but you're right that the section (because it is oriented around describing the RenewalInfo object, rather than client flows) doesn't make that clear. I'll add a new Step 0 which explicitly says that a client should begin by querying the ARI endpoint.

Then, when returning to step 1...

No, the point is that you're not returning to step 1. You're querying the ARI endpoint again, and once you have that response, you then begin at step 1.