Configurable certificate lifetime for the CA server

[marcohald]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

It would be useful to have a config option for the Certificate duration for the ACME Provisioner as discussed here #1049

Why is this needed?

We monitor the validity period of our SSL Certificates and like to have a duration of 30 Days and renew them after 15 Days.
So that we have enough time to troubleshoot any issues with renewing the certificates.

[hslatman]

@marcohald: I've updated the title to better reflect what you're looking for, based on the existing discussion. If I'm correct, you're looking for an option to set the certificate lifetime for the CA HTTPS API, which includes the ACME directory endpoints. At this time the CA will transparently renew the certificate that it uses to serve all endpoints every day. You would like to have an option to make the certificate lifetime to be 30 days and to renew them at half their lifetime.

[marcohald]

@hslatman yes you are correct.
I think it would be better if the lifetime and the renew time could be specified in hours, for the most users that need it customized

[maraino]

I don't understand the need for this, the CA will automatically renew its own certificate, and if it's unable to do it, it won't be able to issue new certificates to anyone. And it's always possible to monitor that the CA always has a valid certificate just doing a request to it.

[hslatman]

After #1685 was merged, this functionality is now a step closer. At the moment it would still require custom code to provide *tls.Config, but it might happen that we provide a way to configure that in a more convenient way sometime.

[sshipway]

We have a default 90d lifetime on the Provisioner, but the RA is still generating a 1d certificate. Autorenewals are working; however, we have also configured Slack integration to notify us of expired certificates, and -- apparently because of the short lifetime -- we're getting daily slack notifications from Smallstep that the RA certificate has expired, even though it autorenews.
Being able to configure the RA to use a 90d certificate would allow renewal to happen comfortably outside the notification window so that we would not be receiving these daily spurious notifications.

[maraino]

@sshipway with this PR #1764, I'm letting the CA decide which lifetime the RA should have.