Short lived (24 hours) ACME certs expiring

1

I have an internal ACME server (using an internal CA) which I use for my incus test cluster. Earlier today I tried evacuating and rebooting a node I ran into this:

root@incus02:~# incus cluster evacuate incus02 -f && reboot
Error: Failed to evacuate instances: Failed to migrate instance "vmtest01" in project "default": Error transferring instance data: Failed waiting for migration control connection on target: tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2026-08-09T15:23:53+02:00 is after 2026-08-09T12:25:04Z

Now, a few hours later, I can run the same command again without issues. That makes me think that the ACME provided cert had expired, and that the lego client isn’t run often enough?

My setup:

  • Three nodes
  • Debian 13
  • Incus 7 LTS
  • haproxy with VIP, in TCP passthrough to incus nodes
  • DNS record incus.home.arpa points to haproxy VIP
  • ACME endpoint issues 24 h certs (smallstep-ca)
  • incus managed the incus.home.arpa cert
                                ┌──────┐
                                │ User │
                                └───┬──┘
                                    │
                                    ▼FQDN: incus.home.arpa
                               ┌─────────┐
                               │ haproxy │
                               └────┬────┘
                                    │
                                    ▼tcp passthrough
┌ Incus cluster ───────────────────────────────────────────────────────┐
│ ┌───────────────────┐   ┌───────────────────┐   ┌───────────────────┐│
│ │ incus01.home.arpa │   │ incus02.home.arpa │   │ incus03.home.arpa ││
│ └───────────────────┘   └───────────────────┘   └───────────────────┘│
└───────────────────────────────────┬──────────────────────────────────┘
                                    │
                                    ▼incus managed cert for incus.home.arpa
                                ┌──────┐
                                │ ACME │
                                └──────┘

Relevant configuration:

config:
  acme.agree_tos: "true"
  acme.ca_url: https://ca.home.arpa/acme/acme/directory
  acme.domain: incus.home.arpa
  acme.email: me@example.com
  cluster.https_address: incus02.home.arpa:8443
  core.https_address: :8443

Can I tune how often the lego client is run?

2

Can you file a bug for it? Issues · lxc/incus · GitHub

Currently the task is setup as daily, so that’s the source of the issue. We should instead run it hourly and have it only kick in a real renewal if we’re getting close to expiry.

3