TLS Certificate Lifetimes Will Officially Reduce to 47 Days

[saudiqbal]

It would be finally nice to accept the PR #4457 to allow defining renewal days before expiry. The lifetime are changing for TLS certificates to 47 days in the next few years.

https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-days

Please add support for negative value for days.

Thanks.

[orangepizza]

this also need to change default value, or have sanity check that use notafter logic if configured value will fall outside of cert's validity period

[xlionjuan]

This can be fixed by implementing ARI.
#4944

[orangepizza]

it still need more sane fallback renewal date even with ARI, as we can't expect ARI on every CA , (ex: ZeroSSL or BuyPass doesn't support ARI) , and ARI fails if one ask ARI info of cert from different CA.