Repository: certbot/certbot
Pull request: Add a changelog entry describing the impacts of ARI on short `renew_before_expiry`
Fixes #10312. This is perhaps overly detailed, but I was hoping that by giving a viable path forward it would forestall requests to change it back, add a flag to ignore ari, or otherwise change the behavior. Very open to suggestions on wording/content/length/etc.

Problem statement:
[Task]: double check ARI & renew_before_expiry info in changelog
### Task description

in this release we:

* fixed an unintended change introduced 4.0.0 where renew_before_expiry could not be shorter than certbot's default renewal time
* introduced ARI support which completely overrides both renew_before_expiry or certbot defaults if ACME renewal info is available for a certificate

there's a couple different PRs working on these things in parallel. before the 4.1.0 release, i personally think it's worth looking over the changelog and ensuring it says what we want about these changes

Hints from issue discussion:

Commit message: Add a changelog entry describing the impacts of ARI on short renew_before_expiry

Patch to review:
diff --git a/certbot/CHANGELOG.md b/certbot/CHANGELOG.md
index adc0a46ab93..a18d45a0cd9 100644
--- a/certbot/CHANGELOG.md
+++ b/certbot/CHANGELOG.md
@@ -37,6 +37,13 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
   polling for finalization readiness.
 * The --preferred-profile and --required-profile flags now have their values stored in
   the renewal configuration so the same setting will be used on renewal.
+* Fixed an unintended change introduced in 4.0.0 where `renew_before_expiry` could not be
+  shorter than certbot's default renewal time. If the server does not provide an ARI
+  response, `renew_before_expiry` will continue to override certbot's default. However,
+  an early ARI response will override a later `renew_before_expiry` time, to account for
+  notifications in case of certificate revocation, especially with the impending deprecation
+  of OCSP (https://letsencrypt.org/2024/12/05/ending-ocsp/). To force a later date, users
+  should remove the cron job installed by default and replace it with one of their own timing.
 
 More details about these changes can be found on our GitHub repo.
 


Code review comments:
diff_hunk: @@ -37,6 +37,13 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
   polling for finalization readiness.
 * The --preferred-profile and --required-profile flags now have their values stored in
   the renewal configuration so the same setting will be used on renewal.
+* Fixed an unintended change introduced in 4.0.0 where `renew_before_expiry` could not be
+  shorter than certbot's default renewal time. If the server does not provide an ARI
+  response, `renew_before_expiry` will continue to override certbot's default. However,
+  an early ARI response will override a later `renew_before_expiry` time, to account for
+  notifications in case of certificate revocation, especially with the impending deprecation
+  of OCSP (https://letsencrypt.org/2024/12/05/ending-ocsp/). To force a later date, users
+  should remove the cron job installed by default and replace it with one of their own timing.
path: certbot/CHANGELOG.md
text: @user1:
this changelog entry is very detailed, but i think we should err on that side of things here

i think it's worth making a minor edit like this to mention systemd timers as i believe things like the certbot snap use that instead of cron, but this otherwise lgtm!

```suggestion
  can replace certbot's default cron job and/or systemd timer with one of their own timing.
```

@author:
good point, forgot about that