chore: upgrade certmagic

[Lustyn]

Our certmagic version is stale since Dec 2020, Let's Encrypt will be making changes soon that mean we should prioritize getting these changes out in a new release ASAP.

We can either:

• Merge upstream changes into our certmagic fork, or:
• Switch to mainline certmagic.

[Lemmmy]

Does our certmagic have any changes other than only retrying once? If it was easier, I wouldn't mind losing this functionality in favor of switching back to mainline certmagic.

It is handy to prevent getting rate limited from LE, but really these situations should just be avoided in the first place, and I think most people who are running enough sites to risk being rate limited now know how to handle it (or are just using self-signed).

A quick glance through the commit history shows that:

• Exponential retry backoff has been tuned multiple times,¹² which is used for obtaining certs and renewing certs
• More consideration has been given to local/internal domains,³ though this is something we can and do handle Casket-side anyway⁴
• DNS propagation checks are now configurable, so we could add settings in Casket for these.⁵ It wouldn't help with rate-limiting, though.
• The internal rate limit was raised?⁶
• Renewal operations no longer block unless the certificate has expired, so even in the event of a potential renewal disaster, the effect should be minimal⁷

I think if we do switch back to mainline certmagic, we can archive our fork and see how things go. If we have any reason to revert back, we could then un-archive and look into rebasing or merging.

Footnotes

1. https://github.com/caddyserver/certmagic/commit/63493552e475e7477e4abf2a66299e31b010b29b ↩

2. https://github.com/caddyserver/certmagic/commit/707ebd945588a33c5db0b48dd243d81019773b6a ↩

3. https://github.com/caddyserver/certmagic/commit/66685874a86f20f433d38d00e2ab8a9250522b0d ↩

4. https://github.com/tmpim/casket/commit/7b076905de9d707a71302d4655dc74d6aa50086b ↩

5. https://github.com/caddyserver/certmagic/commit/8d92ff95bff0993cf2427590c29dee46e8e8b7fe ↩

6. https://github.com/caddyserver/certmagic/commit/14b314f4d6aa5ca1515e243171d1de49be005522 ↩

7. https://github.com/caddyserver/certmagic/commit/2b9800960688e51a69cefe6a8687c6f6484a1694 ↩