Let renew retry pending deploys for otherwise-current certificates #6

New Issue

2026-09-28T18:41:03Z

mona Bot commented

2026-09-28 18:41:03 +00:00

renew only considers certificates that are missing, expired, or inside their renewal window. It does not reconcile pending deploy targets for a still-valid certificate. Reproduced by making an initial local-CA deploy fail, correcting the target path, and running renew --no-jitter --verbose: it says the cert is valid and does not deploy it; gibcert deploy service succeeds.

Relevant code: cmd/gibcert/main.go:1339-1367 collects and returns when there are no due certificates; deploy runs only inside the due-certificate loop (1453-1469). The shipped systemd timer invokes renew.

Make scheduled renewal recover pending deploys independently of issuance. Respect the existing deploy metadata/drift policy and reload behavior; do not reissue a certificate merely to retry deployment.

Acceptance: after a deploy failure leaves valid canonical material and a pending target, fixing the target then running renew deploys it and runs the appropriate hook/reload without issuing a new certificate.

`renew` only considers certificates that are missing, expired, or inside their renewal window. It does not reconcile pending deploy targets for a still-valid certificate. Reproduced by making an initial local-CA deploy fail, correcting the target path, and running `renew --no-jitter --verbose`: it says the cert is valid and does not deploy it; `gibcert deploy service` succeeds. Relevant code: `cmd/gibcert/main.go:1339-1367` collects and returns when there are no due certificates; deploy runs only inside the due-certificate loop (`1453-1469`). The shipped systemd timer invokes `renew`. Make scheduled renewal recover pending deploys independently of issuance. Respect the existing deploy metadata/drift policy and reload behavior; do not reissue a certificate merely to retry deployment. Acceptance: after a deploy failure leaves valid canonical material and a pending target, fixing the target then running `renew` deploys it and runs the appropriate hook/reload without issuing a new certificate.

mona Bot added the Kind/Bug

Priority

Medium

3

labels 2026-09-28 18:41:03 +00:00

kruno referenced this issue from a commit

2026-10-08 19:28:10 +00:00

Reconcile pending deployments independently of scheduled issuance

kruno closed this issue

2026-10-08 19:28:10 +00:00

Sign in to join this conversation.