Add configurable sleep for slow CA order processing#6869
Add configurable sleep for slow CA order processing#6869denisfoulon wants to merge 4 commits intoacmesh-official:devfrom
Conversation
|
Related to #5233, #6103, #6763. This PR improves handling of slow order processing and retry timing for ACME servers returning Retry-After: 0 or taking longer to finalize certificates with many SANs. This follow-up PR removes the unrelated shebang change from the previous attempt and targets dev only. The diff is now limited to the retry/sleep handling for slow CA order processing. |
There was a problem hiding this comment.
Pull request overview
This PR aims to make ACME order polling more resilient to slow CA processing and problematic Retry-After behavior by introducing configurable minimum sleeps and retry thresholds.
Changes:
- Introduces
LE_MIN_RETRY_SLEEPto enforce a minimum delay when handlingRetry-After(notably for503overload responses). - Introduces
LE_MAX_RETRY_AFTER(currently only reflected in log messaging) intended to cap how long the client will wait before giving up. - Adds
LE_PROCESSING_MIN_SLEEPduring order “processing” polling to add additional delay between retries.
|
Hi everyone, I've updated the PR to address the points raised during the review: |
Commit message: Add LE_PROCESSING_MIN_SLEEP for slow CA processing (fixes HARICA timeout) Add env vars for processing loop: - LE_PROCESSING_MIN_SLEEP=15 (line ~5299) - LE_MIN_RETRY_SLEEP=5 (overload_retry) - LE_MAX_RETRY_AFTER=3600 (>600 limit) Tested: HARICA 32-SAN cert success (before: 30s timeout).
Remove unrelated bash shebang change
Handle empty Retry-After headers with default values. Use internal _sleep function for better integration. Align retry thresholds with configurable variables. Ensure sleep logic executes even when Retry-After is 0.
fix arithmetic spacing and indentation for shfmt
|
I've applied the formatting fixes (arithmetic spacing and indentation) to comply with shfmt. Tests should be greener now! Thanks for your help on this. |
This PR keeps the change minimal and shell-compatible.
It adds configurable waiting for slow ACME order processing:
This helps with CAs returning Retry-After: 0 or taking longer to finalize certificates with many SANs.
Tested successfully with a slow CA on a certificate containing many SANs.