Does our certmagic have any changes other than only retrying once? If it was easier, I wouldn't mind losing this functionality in favor of switching back to mainline certmagic.

It is handy to prevent getting rate limited from LE, but really these situations should just be avoided in the first place, and I think most people who are running enough sites to risk being rate limited now know how to handle it (or are just using self-signed).

A quick glance through the commit history shows that:

Exponential retry backoff has been tuned multiple times,¹² which is used for obtaining certs and renewing certs
More consideration has been given to local/internal domains,³ though this is something we can and do handle Casket-side anyway⁴
DNS propagation checks are now configurable, so we could add settings in Casket for these.⁵ It wouldn't help with rate-limiting, though.
The internal rate limit was raised?⁶
Renewal operations no longer block unless the certificate has expired, so even in the event of a potential renewal disaster, the effect should be minimal⁷

I think if we do switch back to mainline certmagic, we can archive our fork and see how things go. If we have any reason to revert back, we could then un-archive and look into rebasing or merging.

Footnotes

chore: upgrade certmagic #19

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions