# TODO — Certificate Issuance Issues

## Problem 1: Timeout Mismatch Causes WebUI Freeze → FIXED

**Date Found:** May 30, 2026
**Date Fixed:** May 30, 2026

**Symptom:** Clicking "Issue Certificate" in the WebUI freezes for ~30 seconds, then returns a 500 error with "Daemon request timed out". Meanwhile the daemon silently runs `acme.sh` in the background for up to 120s before timing out itself.

**Root Cause:**
- `daemon/client.py` — WebUI client uses `timeout=30` for all daemon requests
- `daemon/handlers/acme.py` — Daemon allows `acme.sh` subprocess `timeout=120`
- The WebUI gives up at 30s while the daemon is still legitimately processing

**Fix Applied:** Replaced blocking issue endpoint with async step-by-step issuance:
- `POST /acme/validate` — Pre-flight checks (instant): acme.sh installed, email configured, webroot ready, DNS resolves, challenge configured
- `POST /acme/issue` — Returns immediately with `request_id`, spawns background task
- `GET /acme/issue/status` — Client polls for step-by-step progress
- UI shows pre-check results, then step progress with polling (no timeout issues)
- Blocking DNS check prevents wasted acme.sh calls when domain doesn't resolve

**Files Changed:** `daemon/handlers/acme.py`, `webui/api/certs.py`, `webui/templates/certs.html`, `webui/static/app.js`

---

## Problem 2: ZeroSSL Rate Limits Block Certificate Issuance

**Date Found:** May 30, 2026

**Symptom:** `acme.sh` fails to issue a certificate for `218broad.vacuum.network` with:
```
The retryafter=86400 value is too large (> 600), will not retry anymore.
```

**Root Cause:** ZeroSSL CA returns a `retry-after` of 86400 seconds (24 hours), likely from a prior failed challenge. `acme.sh` has a hard cap of 600s on retry-after values and refuses to proceed when the CA requests a longer wait.

**Files:** N/A (acme.sh behavior, not a project code issue)

**Workarounds:**
- Switch CA to Let's Encrypt: `acme.sh --set-default-ca --server letsencrypt`
- Wait 24 hours and retry
- Investigate and clean up prior failed challenges for the domain on ZeroSSL's side

## Status