acmetool icon indicating copy to clipboard operation
acmetool copied to clipboard

Flag to request new certs - without renewing old certs?

Open jfesler opened this issue 7 years ago • 0 comments

I'm running into the LetsEncrypt limits problem.

From their support site:

To make sure you can always renew your certificates when you need to, we have a Renewal Exemption to the Certificates per Registered Domain limit. Even if you’ve hit the limit for the week, you can still issue new certificates that count as renewals. An issuance request counts as a renewal if it contains the exact same set of hostnames as a previously issued certificate. This is the same definition used for the Duplicate Certificate limit described above. Renewals are still subject to the Duplicate Certificate limit. Also note: the order of renewals and new issuances matters. To get the maximum possible number of certificates, you must perform all new issuances before renewals during a given time window.

The last emphasis is mine.

Is there any way to do a run of acmetool that ignores renewals, but attempts any new certificates?

I'd specifically want to make sure that I can issue a series of "wants" - and get those certificates - before burning LetsEncrypt credits on renewals. Perhaps an option flag "--norenew" honored by the reconciliation stage.

My immediate workaround will be:

  • Move state/desired/* to a holding directory
  • Create new wants, generate keys
  • Move previous state/desired/* back into place

But I imagine this could be a bit trouble prone.

jfesler avatar Dec 20 '17 18:12 jfesler