v2.26.3 (Renewals stop arriving at the certificate authority all at once)
A patch release. One change, and it is about timing, not correctness.
The renewal sweeps are now jittered across a window
The scheduled renewal jobs fired on a fixed cron: the certificate sweep at
exactly 02:00:00, the client-certificate sweep at 03:00:00. On a single
instance that is unremarkable. Across every CertMate in the world it means each
one contacts its ACME certificate authority at the same wall-clock second, a
synchronised load spike the CA has to absorb at those two fixed times every
day. Let's Encrypt asks integrators to renew at randomised times for exactly
this reason.
Both renewal jobs now carry a cron jitter of plus-or-minus one hour, so the
02:00 certificate sweep lands somewhere in 01:00-03:00 and the 03:00
client-certificate sweep in 02:00-04:00 — the same overnight window, but
de-synchronised across installs. It composes with the six-hour misfire grace
and the coalescing already in place, so a sweep that is delayed or missed while
the instance was unavailable still runs, once, on catch-up. Nothing about which
certificates are renewed, or when they become due, changes; only the moment the
sweep begins.