ARI - Run cron job more frequently

[sim0n-v]

With ACME Renewal Info (RFC9773 §4.3), fetching renewal window should be more frequent, e.g. in case of revocation incident.

For instance, a server that needs to revoke certificates within 24 hours of notification of a problem might choose to reserve twelve hours for investigation, six hours for clients to fetch updated RenewalInfo objects, and six hours for clients to perform a renewal.

This PR makes the cron job run every 6 hours (nb: the cron job is not modified during acme.sh upgrades).

More flexible option is to run the cron job even more frequently (e.g. each hour) and store the time at which fetching ARI should be made (using the Retry-After header).

[neilpang]

why not just $_random_minutes */6 * * * ?

[sim0n-v]

I guess $random_minute */6 * * * is the same as $random_minute 0/6 * * *: every clients will request ARI the same hour, and the CA may overload on 0,6,12,18 hours.

Much better if this is randomized across each hour.

As per RFC9773 §4.3:

During the lifetime of a certificate, the renewal information needs to be fetched frequently enough that clients learn about changes in the suggested window quickly, but without overwhelming the server.

[Copilot]

Pull request overview

Adjusts the installed cron schedule to run more frequently (every 6 hours) to better support ACME Renewal Info (ARI) refresh cadence during incident/revocation scenarios.

Changes:

• Change the randomized hour selection to a 6-hour bucket (% 6) instead of daily (% 24).
• Install a single cron entry that runs 4 times/day at 6-hour intervals (hour list h,h+6,h+12,h+18).

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[sim0n-v]

Fix windows scheduler padding for StartTime and random minute/hour.

[sim0n-v]

Update the SCHTASKS to follow the same cronjob logic

[sim0n-v]

The wiki Using systemd units instead of cron should also be updated with something like this:

[Unit]
Description=Renewal of Let's Encrypt's certificates

[Timer]
#OnCalendar=*/6:00:00
OnUnitActiveSec=6h
RandomizedDelaySec=1h
Persistent=true

[Install]
WantedBy=timers.target

[e-nomem]

Persistent=true doesn't do anything for monotonic timers and OnUnitActiveSec requires the target unit to be activated at least once by something, so it usually also requires OnBootSec.

If you have a recent enough version of systemd (v258+), you can do somthing like this:

[Unit]
Description=Renewal of Let's Encrypt's certificates

[Timer]
OnCalendar=0/6:00:00
RandomizedOffsetSec=6h
FixedRandomDelay=true
Persistent=true

[Install]
WantedBy=timers.target

That'll have the timer fire every 6 hours but each individual system will use a different fixed offset in that 6 hour window.