CmdLets Repeatedly asking for DNS Text Records about posh-acme HOT 3 CLOSED

Hi @mrdenny. ACME validations are generally required for every name in a cert on every renewal. Some CAs such as Let’s Encrypt will cache successful validations for a period of time (30 days for LE) such that if you create a new order that contains names with cached validations, those names won’t require revalidation for that order. But names that hadn’t been previously validated or had their cached validations expired will need to revalidate.

from posh-acme.

from posh-acme.

Unfortunately that wont work. The validation cache timer doesn’t get reset without actually performing a new validation. So renewing at 30 days will get you a new 90 day cert. But the next time you renew after that, even the very next day, you’ll be challenged to revalidate those names. Forcing revalidation is part of the CA/B requirements that all public CAs must abide by.

The 30 day window also isn’t part of the ACME spec and is likely to be different or nonexistent for other CAs. Even Let’s Encrypt has said they will likely be lowering that cache window eventually down to 7-10 days.

from posh-acme.