Fix stale renewal check and ACME DNS validation race - #1
Merged
Merged
Conversation
- NeedsNewCertificateAsync() filtered existing certs by issuer containing "Let's Encrypt Authority" (the pre-2021 intermediate name). Current certs are issued by R11/R12/R13/YR1 etc., so the filter never matched, existingCert was always null, and the tool requested a brand-new certificate on every scheduled run instead of honoring TimeBeforeExpiryToRenew. Upstream's own fix for this (n3wt0n#30) just hardcoded "R3" instead, which is equally stale today. Dropped the issuer filter entirely - ExistingCertificates is already scoped to the target hostname. - GetCertificateAsync() called dnsChallenge.Validate() immediately after creating the DNS TXT record, before Azure DNS had time to propagate it. A premature check fails the challenge and flips the authorization out of "pending", so the retry loop's subsequent Validate() calls error with "authorization must be pending" instead of actually retrying. Matches upstream issue n3wt0n#48/n3wt0n#50. Added a configurable delay (default 15s, WaitTimeBeforeValidateInSeconds) before the first validation attempt.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this fixes
Two bugs were causing the Sev1 availability alerts to flap: the cert
was about to expire, and the auto-renewal wasn't renewing it.
1.
NeedsNewCertificateAsync()never found the existing cert.It filtered by
Issuer.Contains("Let's Encrypt Authority"), which wasLet's Encrypt's pre-2021 intermediate CA name. Current certs are
issued by R11/R12/R13/YR1 etc., so the filter never matched,
existingCertwas alwaysnull, and the tool requested a brand-newcertificate on every scheduled run instead of honoring
TimeBeforeExpiryToRenew. Upstream's own fix for this (n3wt0n#30) justhardcoded
"R3"instead, which is equally stale today since LE keepsrotating intermediate names. This PR drops the issuer filter
entirely —
ExistingCertificatesis already scoped to the targethostname a few lines earlier in
GetResourceConfigurationAsync, sono name-matching is needed at all.
2.
GetCertificateAsync()raced Azure DNS propagation.dnsChallenge.Validate()was called immediately after creating the_acme-challengeTXT record. If Azure DNS hadn't propagated therecord yet, Let's Encrypt's first check fails and flips the
authorization out of "pending" — so the existing 90-second retry loop
then errors on every subsequent attempt with
urn:ietf:params:acme:error:malformed: Unable to update challenge :: authorization must be pending, instead of actually retrying. Thismatches n3wt0n#48 and n3wt0n#50 exactly (same error message reported there). This
PR adds a configurable delay (
WaitTimeBeforeValidateInSeconds,default 15s) before the first validation attempt, along the same
lines as n3wt0n#50.
Together these mean the tool only attempts renewal when actually
needed, and that attempt no longer races DNS propagation.