Module manager 

The renewal scheduler: one task per managed certificate that decides when to (re)issue, takes the storage lease so only one instance orders, runs order::issue, persists, publishes into ManagedCerts, and backs off on failure. Instances that lose the lease poll storage and adopt whatever the leaseholder wrote, refreshing challenge certs meanwhile so the CA may validate through any of them.

Structs

AbortOnDrop 🔒

Aborts the wrapped task on drop — including when the future holding it is simply cancelled (e.g. a slot task dropped on shutdown) rather than run to completion, so a lease-keepalive loop can never outlive the order it was keeping alive for. A plain abort() call reached only via a specific success/error path does not cover that case.

ManagedSlot

Manager

ManagerConfig

SlotControl 🔒

Enums

RenewOutcome

Constants

ARI_INTERVAL_SECS 🔒

ARI is re-queried at most this often per certificate.

LEASE_TTL

PLACEHOLDER_REMINT_MARGIN_SECS 🔒

Placeholders are minted with one hour of validity; re-mint this long before they lapse so a slot stuck in Placeholder never serves an expired certificate (design section 4: “re-minted on every restart and hourly while still in Placeholder state”).

Functions

backoff_secs

60·2^(failures−1) seconds, capped at one hour; 0 when there are no failures.

when_to_renew

Unix time at which the certificate should be renewed: renew_before ahead of expiry, or the start of the CA’s ARI window if that comes first.