Static name of the most recent certificate

[SemaiCZE]

Feature Overview

I'd like to access the newest certificate inside the state_path directory. Now it's not possible, because I don't know the exact filename.

When using certbot with Let's Encrypt there is always a symlink to /etc/letsencrypt/live/ while the original files are placed in /etc/letsencrypt/archive/ directory.

Use-case

VPS running mostly web pages, but also a Postfix mail relay. Using nginx with acme module is very convenient, but I need one of the web certificates also for the Postfix configuration. Implementing #13 would help for SSL protocols, but not for Postfix if I want to use STARTTLS.

I know that I need to take care of restarting the app when the certificate is renewed, but that's an easy task.

Alternatives Considered

No response

Additional Context

No response

[bavshin-f5]

The names are already static; it's the first server name + "-" + hash(all the names + the key algorithm).
The problem I had to solve here is avoiding conflicts, unintentional file overwrites, and incorrectly restored certificates when two server blocks have intersecting sets of names. There doesn't seem to be a way around this without incorporating all the configured server names into the file name, and using these verbatim makes the name too long.

certbot uses manually specified names and can report conflicts when interactively adding a new certificate, so the problem doesn't exist for them.

There are two things that stop me from declaring this stable and documenting:

• Instability of the output; some structure layout changes in the past affected the value.
• Lack of implementation for other languages because of the selected hash algorithm.

I'm planning to address both in one of the future releases, but it will be a breaking change.

---

There's an additional difficulty in making this scenario work: the mail module reads the SSL certificates during configuration load and fails if the files are not present. Which is very likely during the initial configuration, because acme starts requesting the certificates only after the configuration is loaded and worker processes are started.

I don't think it's possible to solve this one without adding the variables support in the mail module, and nobody actually wants to do this.