Skip to content

Add configurable sleep for slow CA order processing#6869

Open
denisfoulon wants to merge 4 commits intoacmesh-official:devfrom
denisfoulon:master
Open

Add configurable sleep for slow CA order processing#6869
denisfoulon wants to merge 4 commits intoacmesh-official:devfrom
denisfoulon:master

Conversation

@denisfoulon
Copy link
Copy Markdown

This PR keeps the change minimal and shell-compatible.

It adds configurable waiting for slow ACME order processing:

  • LE_PROCESSING_MIN_SLEEP
  • LE_MIN_RETRY_SLEEP
  • LE_MAX_RETRY_AFTER

This helps with CAs returning Retry-After: 0 or taking longer to finalize certificates with many SANs.

Tested successfully with a slow CA on a certificate containing many SANs.

@denisfoulon
Copy link
Copy Markdown
Author

denisfoulon commented Mar 21, 2026

Related to #5233, #6103, #6763.

This PR improves handling of slow order processing and retry timing for ACME servers returning Retry-After: 0 or taking longer to finalize certificates with many SANs.

This follow-up PR removes the unrelated shebang change from the previous attempt and targets dev only. The diff is now limited to the retry/sleep handling for slow CA order processing.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR aims to make ACME order polling more resilient to slow CA processing and problematic Retry-After behavior by introducing configurable minimum sleeps and retry thresholds.

Changes:

  • Introduces LE_MIN_RETRY_SLEEP to enforce a minimum delay when handling Retry-After (notably for 503 overload responses).
  • Introduces LE_MAX_RETRY_AFTER (currently only reflected in log messaging) intended to cap how long the client will wait before giving up.
  • Adds LE_PROCESSING_MIN_SLEEP during order “processing” polling to add additional delay between retries.

Comment thread acme.sh
Comment thread acme.sh Outdated
Comment thread acme.sh
Comment thread acme.sh Outdated
Comment thread acme.sh Outdated
Comment thread acme.sh
@denisfoulon
Copy link
Copy Markdown
Author

Hi everyone,

I've updated the PR to address the points raised during the review:

Robustness: Added ${_retryafter:-0} to prevent arithmetic syntax errors if the header is missing.

Consistency: Replaced hardcoded 600 thresholds with the ${LE_MAX_RETRY_AFTER} variable.

Best Practices: Switched from sleep to the internal _sleep function.

Coverage: Updated the logic to ensure the configured minimum sleep is respected even if the CA returns Retry-After: 0.

Commit message: Add LE_PROCESSING_MIN_SLEEP for slow CA processing (fixes HARICA timeout)

Add env vars for processing loop:
- LE_PROCESSING_MIN_SLEEP=15 (line ~5299)
- LE_MIN_RETRY_SLEEP=5 (overload_retry)
- LE_MAX_RETRY_AFTER=3600 (>600 limit)

Tested: HARICA 32-SAN cert success (before: 30s timeout).
Remove unrelated bash shebang change
Handle empty Retry-After headers with default values.

Use internal _sleep function for better integration.

Align retry thresholds with configurable variables.

Ensure sleep logic executes even when Retry-After is 0.
fix arithmetic spacing and indentation for shfmt
@denisfoulon
Copy link
Copy Markdown
Author

I've applied the formatting fixes (arithmetic spacing and indentation) to comply with shfmt. Tests should be greener now! Thanks for your help on this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants