Werk #19546: Relay: Renew the certificate early and retry until it succeeds
| Component | Relay | ||||
| Title | Relay: Renew the certificate early and retry until it succeeds | ||||
| Date | Oct 27, 2026 | ||||
| Level | Prominent Change | ||||
| Class | Bug Fix | ||||
| Compatibility | Compatible - no manual interaction needed | ||||
| Checkmk versions & editions |
|
Previously, the relay requested a new client certificate only during the last day before the current one expired, and it tried once or twice. If the site was not reachable at that time, the relay could be left without a valid certificate.
The relay now starts to renew its certificate after two thirds of the certificate's lifetime. With the usual validity of three months, this is around day 60. The relay tries immediately, and then again after a random time of 6 to 24 hours, until the renewal succeeds. The random gap prevents a problem that occurs at the same time every day from blocking all attempts.
The relay log now tells you clearly what happened:
- A successful renewal is logged as "Certificate rotation successful."
- A failed renewal names the step that failed, the error, and how long
the current certificate is still valid, for example:
Certificate rotation failed while requesting a new certificate from the site: <error>. 29 days of certificate validity remaining. If the certificate has already expired, the log says how long ago.
No action is required.