openssl x509 -issuer changed its default output format between
OpenSSL 1.1.1 and 3.x: the old format has no spaces around '='
(O=Let's Encrypt), the new one does (O = Let's Encrypt). The
renew.sh issuer check used a literal grep -q "O=Let's Encrypt", so
on OpenSSL 3.x (e.g. current ESXi releases) it never matches and
the script treats every existing Let's Encrypt cert as untrusted,
requesting a brand new certificate on every scheduled run instead
of only when it's actually close to expiry. This risks hitting
Let's Encrypt's rate limits.
Match the issuer with optional whitespace around '=' so it works
with both OpenSSL output formats.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Letsencrypt has some hiccups sometimes during renewals. Instead of instantly replacing a still valid cert with a self-signed, it should be kept, while it hasn't expired
andyandClaude Sonnet 5
Johannes Feichtner