Short lived ACME certs expiring

[oscarcarlsson]

Is there an existing issue for this?

• There is no existing issue for this bug

Is this happening on an up to date version of Incus?

• This is happening on a supported version of Incus

Incus system details

config:
  acme.agree_tos: "true"
  acme.ca_url: https://ca.home.arpa/acme/acme/directory
  acme.domain: incus.home.arpa
  acme.email: me@example.com
  cluster.https_address: incus03.home.arpa:8443
  core.bgp_address: 192.168.0.73:179
  core.bgp_asn: "65012"
  core.bgp_routerid: 192.168.0.73
  core.https_address: :8443
  core.https_trusted_proxy: 172.19.99.5
  oidc.audience: https://incus.home.arpa
  oidc.claim: preferred_username
  oidc.client.id: 
  oidc.issuer: https://auth.example.com
  oidc.scopes: openid,offline_access
api_extensions_count: 529
api_status: stable
api_version: "1.0"
auth: trusted
public: false
auth_methods:
  - tls
  - oidc
auth_user_name: root
auth_user_method: unix
environment:
  addresses:
    - 192.168.0.73:8443
    - '[fdcd:f764:d926:501:6e4b:90ff:feb9:b166]:8443'
    - '[fdcd:f764:d926:501:a909:cf66:94d4:989f]:8443'
    - 10.69.214.1:8443
  architectures:
    - x86_64
    - i686
  certificate: ""
  certificate_fingerprint: 1132f57daec60dbbf50ddcb2d5e22ee3130963dc3d6071d06b846476a7f52896
  driver: lxc | qemu
  driver_version: 7.0.0 | 11.0.3
  firewall: nftables
  kernel: Linux
  kernel_architecture: x86_64
  kernel_features: {}
  kernel_version: 6.12.101+deb13-amd64
  lxc_features: {}
  os_name: Debian GNU/Linux
  os_version: "13"
  project: default
  server: incus
  server_clustered: true
  server_event_mode: full-mesh
  server_name: incus03
  server_pid: 1477
  server_version: 7.0.1
  storage: ""
  storage_version: ""
  storage_supported_drivers:
    - name: dir
      version: "1"
      remote: false
    - name: truenas
      version: 0.7.7
      remote: true
    - name: btrfs
      version: "6.14"
      remote: false

Instance details

No response

Instance log

No response

Current behavior

No response

Expected behavior

Short lived ACME issued certificates renewed before expiry

Steps to reproduce

1. Use short lived (24 hours in my case) ACME certificates
2. Setup incus to use said ACME issuer

root@incus02:~# incus cluster evacuate incus02 -f && reboot
Error: Failed to evacuate instances: Failed to migrate instance "vmtest01" in project "default": Error transferring instance data: Failed waiting for migration control connection on target: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2026-08-09T15:23:53+02:00 is after 2026-08-09T12:25:04Z

[oscarcarlsson]

Some more context if interesting: https://discuss.linuxcontainers.org/t/short-lived-24-hours-acme-certs-expiring/27078