Repository navigation
Tell the core which certificate a renewal replaces - #8
Merged
Merged
Conversation
The core recorded each renewal as a new certificate, leaving the old one ISSUED to alert later about a certificate nothing was serving. This host is the only thing that knows which certificate it is replacing, so a renewal now sends it: `renews`, the certificate_id the core returned when it was issued. The core's matching change (certpilot) updates that record in place; a core that predates it ignores the field, which it has always declared and never read. Verified: TestARenewalSaysWhichCertificateItReplaces, against a fake core, failed first (the renewal sent no renews) and passes; a first request still sends none. go test ./... and go vet pass. End to end against a core built from the certpilot branch on PostgreSQL: a renewal from this build updated the existing record (renewal_count 2) rather than adding one. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
A renewal now sends
renews: thecertificate_idthe core returned when the certificate was issued. The core's matching change in certpilot uses it to update that record in place, instead of recording a second certificate and leaving the old oneISSUEDto alert later. A core that predates the change ignores the field.How it was verified
TestARenewalSaysWhichCertificateItReplaces, against a fake core. It failed first (norenewssent) and now passes. A first request still sends none.go test ./...andgo vetpass.renewal_count2) rather than adding one.🤖 Generated with Claude Code