Add certificate expiry handling to renewal job

Stored expiry date is checked before renewal. If less than 30 days out
renewal is attempted. Tests are update to reflect the fact that
dehydrated is not going to be called.

Author: brianlund

lib/resty/auto-ssl/jobs/renewal.lua

@@ -45,6 +45,19 @@ local function renew_check_cert_unlock(domain, storage, local_lock, distributed_
 end
 
 local function renew_check_cert(auto_ssl_instance, storage, domain)
+  ngx.log(ngx.NOTICE, "auto-ssl: checking certificate renewals for ", domain)
+
+  -- Attempt to retrieve expiry date from storage. If it is not found try renewal.
+  -- If expiry date is found, we attempt renewal if it's within 30 days.
+  local _, _, _, expiry = storage:get_cert(domain)
+  if expiry then
+    local now = ngx.now()
+    if now + (30 * 24 * 60 * 60) < expiry then
+      ngx.log(ngx.NOTICE, "auto-ssl: expiry date is more than 30 days out, skipping renewal: ", domain)
+      return
+    end
+  end
+
   -- Before issuing a cert, create a local lock to ensure multiple workers
   -- don't simultaneously try to register the same cert.
   local local_lock, new_local_lock_err = lock:new("auto_ssl", { exptime = 30, timeout = 30 })
@@ -106,7 +119,6 @@ local function renew_check_cert(auto_ssl_instance, storage, domain)
   -- Trigger a normal certificate issuance attempt, which dehydrated will
   -- skip if the certificate already exists or renew if it's within the
   -- configured time for renewals.
-  ngx.log(ngx.NOTICE, "auto-ssl: checking certificate renewals for ", domain)
   local _, _, issue_err = ssl_provider.issue_cert(auto_ssl_instance, domain)
   if issue_err then
     ngx.log(ngx.ERR, "auto-ssl: issuing renewal certificate failed: ", err)

t/file.t

@@ -263,8 +263,8 @@ received: Connection: close
 received: 
 received: foo
 --- error_log
-(Longer than 30 days). Skipping
 auto-ssl: checking certificate renewals for
+auto-ssl: expiry date is more than 30 days out
 --- no_error_log
 [warn]
 [error]

t/redis.t

@@ -280,8 +280,8 @@ received: Connection: close
 received: 
 received: foo
 --- error_log
-(Longer than 30 days). Skipping
 auto-ssl: checking certificate renewals for
+auto-ssl: expiry date is more than 30 days out
 --- no_error_log
 [warn]
 [error]
@@ -549,8 +549,8 @@ received: Connection: close
 received: 
 received: foo
 --- error_log
-(Longer than 30 days). Skipping
 auto-ssl: checking certificate renewals for
+auto-ssl: expiry date is more than 30 days out
 --- no_error_log
 [warn]
 [error]