> Running certbot daily will currently do nothing. It won't think that the certificate needs to be replaced since it has not yet reached the limit required to renew.
Yep, this. Clients need to be built to support it.
I know this is from the linked article and not from you, but:
> In order to get all those certificates replaced, we need an efficient and automated way to notify ACME clients that they should perform early renewal.
This is already possible. It's called OCSP stapling, and it's what Caddy (and CertMagic) does by default, automatically. When Caddy sees from OCSP that the certificate is revoked, it will automatically replace it.
Yep, this. Clients need to be built to support it.
I know this is from the linked article and not from you, but:
> In order to get all those certificates replaced, we need an efficient and automated way to notify ACME clients that they should perform early renewal.
This is already possible. It's called OCSP stapling, and it's what Caddy (and CertMagic) does by default, automatically. When Caddy sees from OCSP that the certificate is revoked, it will automatically replace it.