search

freeipa / freeipa-letsencrypt

A quick hack allowing to use Let's Encrypt certificates for FreeIPA web interface.
140 stars 71 forks source link

Certificates are requested every two days #46

Closed Shirkanesi closed 9 months ago

Shirkanesi commented 9 months ago

Currently the script renews the issued certificate every two days, which seems quite odd. Shouldn't the script check for how long the certificate is valid and just renew it roughly 30 days before expiry.

rcritten commented 9 months ago

I think you are right. It looks like this was due to a conversion error from using NSS to openssl. The original NSS command did a validity check to be sure the certificate was still valid in two days. The current check only allows it to be valid for two days. It should probably use -enddate instead of -startdate, and modify the diff to be:

let diff=($end_timestamp-$now_timestamp)/86400