mirror of
https://github.com/dehydrated-io/dehydrated.git
synced 2026-01-13 23:23:32 +01:00
Support ACME Renewal Information (ARI) #633
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @domrim on GitHub (Feb 4, 2025).
As Let's Encrypt is deprecating Expiration Mails (https://letsencrypt.org/2025/01/22/Ending-Expiration-Emails) it would be nice if dehydrate could support ACME Renewal Information (ARI). For more background, there is a blogpost
An in depth guide for implementing can be found in the Let's Encrypt blog: https://letsencrypt.org/2024/04/25/guide-to-integrating-ari-into-existing-acme-clients/
@BtbN commented on GitHub (Feb 11, 2025):
https://github.com/dehydrated-io/dehydrated/pull/959
@GTAXL commented on GitHub (May 31, 2025):
I agree, this feature should be added. While I don't agree that it's a solution to the expiration e-mails, and you are running dehydrated in a cron or sleep loop anyway to renew at <=32, I think it's a solution for revocation that happens CA side.
For example, in 2020 Let's Encrypt had to revoke approximately 3 million certificates due to not properly validating CAA records. In 2024 DigiCert had to revoke 83,000 certificates due to a bug in their CNAME-based DCV.
Both of these Certificate Authorities support ARI for their ACME servers. If dehydrated supported in, in the event one, or many of your certificates was affected and subsequently revoked, ARI would of sent a shorter expiration date and the certificate would of been renewed within whatever time frame you cycle your dehydrated. This process would of been completely automated in the background and resolved itself, rather than users having to check if their certs are affected and issuing a manual forced renew.