- Shipped
- March 17, 2026 at 11:02 PM UTC
- Author
- Kamo
- Commit
- f57b28b
The auto-cert service was importing expired certs from shared storage and skipping Certificate CR creation, so cert-manager couldn't manage renewals. Also fixed blind inclusion of all standard subdomains which caused HTTP-01 challenges to fail for domains without DNS records. - Add cert expiration checking before importing from shared storage - Always create Certificate CR so cert-manager can auto-renew - Only include subdomains actually seen in Traefik logs (have DNS) - Add expired cert detection to trigger renewal for known domains - Add google.com to blacklist - Fix domains not being marked as known when cert CR already exists