Caddy failed to renew ACME certificate despite available renewal-info

General
1

Hi,

our certificate provider had to revoke a bunch of certificates over the weekend. They informed that ACME renewal information (ARI) is in use and clients that support the extension should renew certificates automatically.

However, none of our caddy servers did that. I checked the renewal information for one certificate (manually constructed the link) and it showed this:

{
    "suggestedWindow": {
        "start": "2026-07-16T00:00:00Z",
        "end": "2026-07-19T23:59:59Z"
    }
}

This is our Caddyfile (sensitive information stripped):

# Caddyfile
{
        email EMAIL
        acme_ca https://acme/account/directory
        acme_eab {
                key_id KEY
                mac_key MAC
        }
        log {
                level debug
        }
}

server.example.com {
        bind public_ipv4 
        reverse_proxy 127.0.0.1:8080
        encode gzip zstd
}

Greatful for any hints on why things did not work as expected.

2

Hi. We are running a similar problem. From mypoint of view that happend due to the lack of the renewal_info in the certificate metadata stored by caddy. Since we have to do the same thing in a larger amount i currently try to understand if I simply can wire an invalid entry into the metadata.

3

I just realized that we run outdated versions of caddy (2.6.2) for some services. The more recent versions of caddy report ARI errors like this:

Jul 22 07:41:06 hostname caddy[1106]: {"level":"error","ts":1784698866.4338744,"logger":"tls.cache.maintenance","msg":"updating ARI","error":"could not fully update ACME renewal info: either no issuer supporting ARI is configured for certificate, or all such failed (make sure the ACME CA that issued the certificate is configured)"}