Server Template shows “Default (7 days)” for Let's Encrypt renewal, but backend default is 21 days

Virtualmin
1

System information

Component Version
OS Debian 11
Webmin 2.653
Virtualmin 8.1.0.gpl-1
Webserver Apache/2.4.67

Problem

In:

System Settings → Server Templates → Default Settings → SSL website for domain

the setting:

Days before expiry to renew SSL certificates

is displayed as:

Default (7 days)

However, the backend renewal code appears to use 21 days as the default.

This also seems consistent with the Virtualmin 7.40.0 changelog entry:

Change Let’s Encrypt renewal default to 21 days before expiry

What I checked

There is no explicit renewal interval configured in the Virtualmin module configuration:

# grep '^renew_letsencrypt=' /etc/webmin/virtual-server/config
#

The default template obtains the value from the module configuration:

'ssl_renew_letsencrypt' => $config{'renew_letsencrypt'},

The renewal logic in feature-ssl.pl then contains:

# Is it time? Either the user-chosen number of months has passed, or
# the cert is within 21 days of expiry
my $tmpl = &get_template($d->{'template'});
my $before = $tmpl->{'ssl_renew_letsencrypt'} || 21;
my $day = 24 * 60 * 60;
my $age = time() - $ltime;
my $rf = rand() * 3600;
my $renew = $expiry && $expiry - time() < $before * $day + $rf;
next if (!$renew);

So when renew_letsencrypt is unset, the effective backend default appears to be 21 days.

Web UI string

I checked where the displayed value comes from:

# grep -n 'newweb_renew_letsencrypt_def' \
    /usr/share/webmin/virtual-server/lang/en

1966:newweb_renew_letsencrypt_def=Default (7 days)

The corresponding UI code in feature-ssl.pl is:

# Days before expiry to auto-renew?
print &ui_table_row(
        &hlink($text{'newweb_renew_letsencrypt'}, "config_renew_letsencrypt"),
        &ui_opt_textbox("ssl_renew_letsencrypt",
                $tmpl->{'ssl_renew_letsencrypt'},
                6, $tmpl->{'default'} ? $text{'newweb_renew_letsencrypt_def'}
                                      : $text{'tmpl_default'}));

I also searched the installed Virtualmin files and found the same Default (7 days) wording in several translated language files:

# grep -RniE '7.?days|renew_letsencrypt.*7|7.*renew_letsencrypt' \
    /usr/share/webmin/virtual-server

Relevant result:

/usr/share/webmin/virtual-server/lang/en:1966:newweb_renew_letsencrypt_def=Default (7 days)

Observed renewal behaviour

The actual renewal behaviour on this server also appears consistent with a 21-day threshold.

Virtualmin invokes Certbot with --force-renewal, and several certificates were renewed approximately 21 days before their previous expiry dates.

For example:

Previous expiry     Virtualmin renewal
20 Sep 2026         30 Aug 2026
21 Sep 2026         31 Aug 2026
22 Sep 2026         01 Sep 2026
24 Sep 2026         03 Sep 2026

The Certbot log shows Virtualmin forcing the renewal, for example:

Arguments: [... '--force-renewal', ... '--no-autorenew']
Auto-renewal forced with --force-renewal...
Renewing an existing certificate ...

The separate Certbot renewal files contain entries such as:

# renew_before_expiry = 30 days

but these are commented out and do not appear to control Virtualmin’s own renewal threshold.

Expected behaviour

If the backend default is 21 days, I think the Server Template UI should display:

Default (21 days)

rather than:

Default (7 days)

There are no renewal failures associated with this. The backend renewal behaviour appears to be correct; this looks like a stale Web UI language string following the change of the default renewal threshold to 21 days.