Where to set the duration for the ACME Provisioner

[marcohald]

Can I set the Minimum Duration for the ACME Provisioner itself.
I mean the Service which is running on the server where stepca is installed not the issued Certificates from it.
I tried it with "minTLSCertDuration": "2160h" but it only generates a 24h validity certificate

[tashian]

The step-ca server uses short-lived certificates for security.
I don't think you can extend the lifetime of the leaf cert without making a custom build of step-ca.
Can you share a bit more about what you're trying to achieve by extending the lifetime?

[maraino]

step-ca will automatically update its certificate with a valid one every ~16h

[marcohald]

I'd like to monitor the ACME API Certificate validity.
The default validity we'd like to use is 30 days in our environment.

[tashian]

Ok! Well, there's no configuration for the internal certificate lifetime, so you'll need a custom build of step-ca if you want a 30 day lifetime on that cert. I think you'd want to change this line in the source.

[marcohald]

Is it possible to add a config option for this?
I would prefer to not build it on my own everytime a update is released

[maraino]

@marcohald, I'd suggest you add an issue for this, it will be triaged next week.