release: improve Linux defaults and harden renewal workflow

amallek · amallek · commit d0a7d0e82b02 · 2026-03-22T11:14:27.000+01:00
certbro-public-snapshot: true
certbro-private-commit: a6db945df26c73b4157d2801a4c991b8d0183b6c
certbro-private-branch: main
diff --git a/.gitignore b/.gitignore
@@ -4,6 +4,8 @@ dist/
 certbro
 scripts/publish-public.sh
 scripts/release-current.sh
+scripts/release-devel.sh
+scripts/testdeploy.sh
 scripts/new-alias-deploy.sh
 *.log
 *.pem
diff --git a/README.de.md b/README.de.md
@@ -41,7 +41,7 @@ curl -fsSL https://install.certbro.com/rf | CERTBRO_VERSION=v0.1.0 sh
 
 ## Schnellstart
 
-Für Server-Deployments eine systemweite State-Datei verwenden:
+Standardmäßig nutzt `certbro` `/etc/certbro/state.json` als State-Datei und `/etc/certbro` als Root für verwaltete Zertifikate. Die folgenden Befehle nennen die Pfade der Klarheit halber trotzdem explizit:
 
 ```sh
 sudo mkdir -p /etc/certbro
diff --git a/README.md b/README.md
@@ -41,7 +41,7 @@ curl -fsSL https://install.certbro.com/rf | CERTBRO_VERSION=v0.1.0 sh
 
 ## Quick Start
 
-Use a system-wide state file for server deployments:
+By default, `certbro` uses `/etc/certbro/state.json` as the state file and `/etc/certbro` as the managed certificates root. The commands below keep the paths explicit for clarity:
 
 ```sh
 sudo mkdir -p /etc/certbro
diff --git a/docs/de/getting-started.md b/docs/de/getting-started.md
@@ -29,7 +29,7 @@ curl -fsSL https://install.certbro.com/rf | CERTBRO_VERSION=v0.1.0 sh
 
 ## Konfiguration
 
-Für Server-Deployments ist eine eigene State-Datei unter `/etc/certbro` sinnvoll. So bleiben Konfiguration und verwalteter Zertifikatszustand an einem Ort:
+Standardmäßig nutzt `certbro` `/etc/certbro/state.json` und `/etc/certbro`. Für Server-Deployments bleiben damit Konfiguration und verwalteter Zertifikatszustand an einem Ort:
 
 ```sh
 sudo mkdir -p /etc/certbro
diff --git a/docs/en/getting-started.md b/docs/en/getting-started.md
@@ -29,7 +29,7 @@ curl -fsSL https://install.certbro.com/rf | CERTBRO_VERSION=v0.1.0 sh
 
 ## Configure
 
-For server deployments, a dedicated state file under `/etc/certbro` keeps configuration and managed certificate state in one place:
+By default, `certbro` uses `/etc/certbro/state.json` and `/etc/certbro`. For server deployments, these defaults keep configuration and managed certificate state in one place:
 
 ```sh
 sudo mkdir -p /etc/certbro
diff --git a/internal/api/client.go b/internal/api/client.go
@@ -122,6 +122,7 @@ type TLSCertificate struct {
 	OrderState             string                 `json:"order_state,omitempty"`
 	RevocationScope        string                 `json:"revocation_scope,omitempty"`
 	RevocationPendingScope string                 `json:"revocation_pending_scope,omitempty"`
+	RenewalSupported       bool                   `json:"renewal_supported,omitempty"`
 	ReissueSupported       bool                   `json:"reissue_supported"`
 	ValidityDays           int                    `json:"validity_days,omitempty"`
 	SerialNumber           string                 `json:"serial_number,omitempty"`
diff --git a/internal/api/client_test.go b/internal/api/client_test.go
@@ -122,6 +122,7 @@ func TestGetCertificateParsesCurrentOpenAPIFields(t *testing.T) {
 				"order_state": "ISSUED",
 				"revocation_scope": "certificate",
 				"revocation_pending_scope": "order",
+				"renewal_supported": true,
 				"reissue_supported": true,
 				"validity_days": 199,
 				"valid_from": "2026-03-18T10:00:00Z",
@@ -157,6 +158,9 @@ func TestGetCertificateParsesCurrentOpenAPIFields(t *testing.T) {
 	if cert.RevocationScope != "certificate" || cert.RevocationPendingScope != "order" {
 		t.Fatalf("revocation scopes = %q / %q", cert.RevocationScope, cert.RevocationPendingScope)
 	}
+	if !cert.RenewalSupported {
+		t.Fatalf("RenewalSupported = %v, want true", cert.RenewalSupported)
+	}
 	if !cert.OrderCancellable || cert.OrderCancellationMode != "revoke_issued" {
 		t.Fatalf("order cancellation fields = %#v", cert)
 	}
diff --git a/internal/app/app.go b/internal/app/app.go
@@ -73,7 +73,7 @@ func (a *App) Run(ctx context.Context, args []string) error {
 	root.StringVar(&opts.StateFile, "state-file", defaultStateFile, "path to certbro state file")
 	root.StringVar(&opts.APIKey, "api-key", "", "regfish API key")
 	root.StringVar(&opts.APIBaseURL, "api-base-url", "", "override API base URL")
-	root.StringVar(&opts.CertificatesDir, "certificates-dir", strings.TrimSpace(os.Getenv("CERTBRO_CERTIFICATES_DIR")), "root directory for certbro-managed certificate directories")
+	root.StringVar(&opts.CertificatesDir, "certificates-dir", firstNonEmpty(strings.TrimSpace(os.Getenv("CERTBRO_CERTIFICATES_DIR")), config.DefaultCertificatesDir), "root directory for certbro-managed certificate directories")
 	root.Usage = func() {
 		a.printRootUsage()
 	}
@@ -867,13 +867,8 @@ func (a *App) storeForRenew(root rootOptions, store *config.Store) (*config.Stor
 		return nil, err
 	}
 
-	merged := &config.Store{
-		Version:           store.Version,
-		APIKey:            store.APIKey,
-		APIBaseURL:        store.APIBaseURL,
-		ContactEmail:      store.ContactEmail,
-		UserAgentInstance: store.UserAgentInstance,
-	}
+	merged := *store
+	merged.ManagedCertificates = nil
 	seen := map[string]struct{}{}
 	for _, cert := range discovered {
 		key := cert.Name
@@ -889,7 +884,7 @@ func (a *App) storeForRenew(root rootOptions, store *config.Store) (*config.Stor
 		seen[key] = struct{}{}
 		merged.ManagedCertificates = append(merged.ManagedCertificates, cert)
 	}
-	return merged, nil
+	return &merged, nil
 }
 
 func firstNonEmpty(values ...string) string {
diff --git a/internal/app/app_test.go b/internal/app/app_test.go
@@ -287,3 +287,43 @@ func TestNewClientIgnoresUserAgentInstanceEnvVar(t *testing.T) {
 		t.Fatalf("client.UserAgent = %q, must not use env override", client.UserAgent)
 	}
 }
+
+func TestStoreForRenewPreservesVerifiedAPIConfiguration(t *testing.T) {
+	root := t.TempDir()
+	outputDir := filepath.Join(root, "example.com")
+	validatedAt := time.Now().UTC().Round(time.Second)
+
+	managed := config.ManagedCertificate{
+		Name:          "example-com",
+		CommonName:    "example.com",
+		OutputDir:     outputDir,
+		CertificateID: "CERT123",
+	}
+	if err := config.SaveManagedCertificate(outputDir, managed); err != nil {
+		t.Fatalf("SaveManagedCertificate() error = %v", err)
+	}
+
+	store := &config.Store{
+		Version:           config.CurrentVersion,
+		APIKey:            "valid-key",
+		APIBaseURL:        "https://api.regfish.com",
+		APIKeyValidatedAt: &validatedAt,
+		ContactEmail:      "ops@example.com",
+		UserAgentInstance: "host-01",
+	}
+
+	app := &App{}
+	renewStore, err := app.storeForRenew(rootOptions{CertificatesDir: root}, store)
+	if err != nil {
+		t.Fatalf("storeForRenew() error = %v", err)
+	}
+	if renewStore.APIKeyValidatedAt == nil || !renewStore.APIKeyValidatedAt.Equal(validatedAt) {
+		t.Fatalf("renewStore.APIKeyValidatedAt = %v, want %v", renewStore.APIKeyValidatedAt, validatedAt)
+	}
+	if renewStore.APIKey != store.APIKey || renewStore.APIBaseURL != store.APIBaseURL {
+		t.Fatalf("renewStore API configuration = %#v, want preserved global configuration", renewStore)
+	}
+	if len(renewStore.ManagedCertificates) != 1 || renewStore.ManagedCertificates[0].Name != "example-com" {
+		t.Fatalf("renewStore.ManagedCertificates = %#v", renewStore.ManagedCertificates)
+	}
+}
diff --git a/internal/app/manager.go b/internal/app/manager.go
@@ -879,6 +879,10 @@ func planRenewal(now time.Time, managed config.ManagedCertificate, remote *api.T
 		return renewalReissue
 	}
 
+	if !remote.RenewalSupported {
+		return renewalNewOrder
+	}
+
 	if remote.ID != "" {
 		return renewalOrder
 	}
diff --git a/internal/app/manager_test.go b/internal/app/manager_test.go
@@ -77,6 +77,7 @@ func TestPlanRenewal(t *testing.T) {
 			},
 			remote: &api.TLSCertificate{
 				ID:                 "7K9QW3M2ZT8HJ",
+				RenewalSupported:   true,
 				Status:             "issued",
 				ReissueSupported:   true,
 				ValidUntil:         &nearValidUntil,
@@ -92,6 +93,7 @@ func TestPlanRenewal(t *testing.T) {
 			},
 			remote: &api.TLSCertificate{
 				ID:                 "7K9QW3M2ZT8HJ",
+				RenewalSupported:   true,
 				Status:             "issued",
 				ReissueSupported:   true,
 				ValidUntil:         &nearValidUntil,
@@ -107,6 +109,7 @@ func TestPlanRenewal(t *testing.T) {
 			},
 			remote: &api.TLSCertificate{
 				ID:                 "7K9QW3M2ZT8HJ",
+				RenewalSupported:   true,
 				Status:             "issued",
 				ReissueSupported:   true,
 				ValidUntil:         &farValidUntil,
@@ -123,6 +126,7 @@ func TestPlanRenewal(t *testing.T) {
 			},
 			remote: &api.TLSCertificate{
 				ID:                 "7K9QW3M2ZT8HJ",
+				RenewalSupported:   true,
 				Status:             "issued",
 				ReissueSupported:   true,
 				ValidUntil:         &farValidUntil,
@@ -131,6 +135,22 @@ func TestPlanRenewal(t *testing.T) {
 			force: true,
 			want:  renewalReissue,
 		},
+		{
+			name: "near expiry without renewal support falls back to new order",
+			managed: config.ManagedCertificate{
+				ReissueLeadDays: 7,
+				RenewBeforeDays: 7,
+			},
+			remote: &api.TLSCertificate{
+				ID:                 "7K9QW3M2ZT8HJ",
+				RenewalSupported:   false,
+				Status:             "issued",
+				ReissueSupported:   false,
+				ValidUntil:         &nearValidUntil,
+				ContractValidUntil: &equalContractEnd,
+			},
+			want: renewalNewOrder,
+		},
 	}
 
 	for _, tc := range tests {
@@ -341,6 +361,7 @@ func TestRenewOneAppliesValidityOverrideToRenewalOrder(t *testing.T) {
 					"provider": "digicert",
 					"dns_names": ["example.com"],
 					"order_state": "ISSUED",
+					"renewal_supported": true,
 					"reissue_supported": true,
 					"certificate_pem_available": true,
 					"valid_until": "` + oldValidUntil.Format(time.RFC3339) + `",
@@ -393,6 +414,7 @@ func TestRenewOneAppliesValidityOverrideToRenewalOrder(t *testing.T) {
 					"provider": "digicert",
 					"dns_names": ["example.com"],
 					"order_state": "ISSUED",
+					"renewal_supported": true,
 					"reissue_supported": true,
 					"certificate_pem_available": true,
 					"valid_until": "` + newValidUntil.Format(time.RFC3339) + `",
@@ -463,6 +485,7 @@ func TestRenewOneRejectsValidityOverrideForReissue(t *testing.T) {
 					"provider": "digicert",
 					"dns_names": ["example.com"],
 					"order_state": "ISSUED",
+					"renewal_supported": true,
 					"reissue_supported": true,
 					"certificate_pem_available": true,
 					"valid_until": "` + validUntil.Format(time.RFC3339) + `",
diff --git a/internal/config/store.go b/internal/config/store.go
@@ -17,6 +17,10 @@ import (
 const (
 	// CurrentVersion is the schema version of the persisted global state file.
 	CurrentVersion = 1
+	// DefaultStateFilePath is the default global state file path for Linux deployments.
+	DefaultStateFilePath = "/etc/certbro/state.json"
+	// DefaultCertificatesDir is the default root directory for managed certificate trees.
+	DefaultCertificatesDir = "/etc/certbro"
 	// DefaultRenewBeforeDays is the default lead time before expiry for renewals.
 	DefaultRenewBeforeDays = 7
 	// DefaultReissueLeadDays is the default lead time used when reissue is required.
@@ -133,16 +137,12 @@ type ManagedCertificate struct {
 	UpdatedAt          time.Time  `json:"updated_at"`
 }
 
-// DefaultPath returns the default state file location for the current user.
+// DefaultPath returns the default certbro state file path.
 func DefaultPath() (string, error) {
 	if env := strings.TrimSpace(os.Getenv("CERTBRO_STATE_FILE")); env != "" {
 		return env, nil
 	}
-	dir, err := os.UserConfigDir()
-	if err != nil {
-		return "", fmt.Errorf("determine config dir: %w", err)
-	}
-	return filepath.Join(dir, "certbro", "state.json"), nil
+	return DefaultStateFilePath, nil
 }
 
 // Load reads the global certbro state file, returning an empty store when it does not exist.
diff --git a/internal/config/store_test.go b/internal/config/store_test.go
@@ -10,6 +10,30 @@ import (
 	"time"
 )
 
+func TestDefaultPathUsesLinuxSystemDefault(t *testing.T) {
+	t.Setenv("CERTBRO_STATE_FILE", "")
+
+	got, err := DefaultPath()
+	if err != nil {
+		t.Fatalf("DefaultPath() error = %v", err)
+	}
+	if got != DefaultStateFilePath {
+		t.Fatalf("DefaultPath() = %q, want %q", got, DefaultStateFilePath)
+	}
+}
+
+func TestDefaultPathPrefersEnvironmentOverride(t *testing.T) {
+	t.Setenv("CERTBRO_STATE_FILE", "/tmp/custom-state.json")
+
+	got, err := DefaultPath()
+	if err != nil {
+		t.Fatalf("DefaultPath() error = %v", err)
+	}
+	if got != "/tmp/custom-state.json" {
+		t.Fatalf("DefaultPath() = %q, want env override", got)
+	}
+}
+
 func TestSaveAndLoadStorePreservesUserAgentMetadata(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "state.json")
 	want := &Store{
diff --git a/scripts/release-devel.sh b/scripts/release-devel.sh
diff --git a/scripts/test-smoke.sh b/scripts/test-smoke.sh
diff --git a/scripts/testdeploy.sh b/scripts/testdeploy.sh

Original file line number	Diff line number	Diff line change
`@@ -879,6 +879,10 @@ func planRenewal(now time.Time, managed config.ManagedCertificate, remote *api.T`
`879`	`879`	`return renewalReissue`
`880`	`880`	`}`
`881`	`881`
	`882`	`+ if !remote.RenewalSupported {`
	`883`	`+ return renewalNewOrder`
	`884`	`+ }`
	`885`	`+`
`882`	`886`	`if remote.ID != "" {`
`883`	`887`	`return renewalOrder`
`884`	`888`	`}`