Fix: make renewal_manager callback only on renewal

Author: mesudip

setup.py

@@ -2,7 +2,7 @@
 
 setup(
     name="certapi",
-    version="1.1.10",
+    version="1.1.11",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[

src/certapi/client/renewal_manager.py

@@ -192,16 +192,15 @@ def start(self):
         """
         Start the background renewal worker.
 
-        The worker immediately performs a forced renewal pass, then sleeps until
-        the next watched certificate approaches the renewal threshold or until
-        another thread publishes a new set with :meth:`update_watch_domains`.
+        The worker sleeps until the next watched certificate approaches the
+        renewal threshold or until another thread publishes a new set with
+        :meth:`update_watch_domains`.
         Calling ``start`` while already running is a no-op.
         """
         with self._lock:
             if self._running:
                 return
             self._running = True
-            self._cycle_requested = True
             self._thread = threading.Thread(target=self._worker, name="CertApi-RenewalManager", daemon=True)
             self._thread.start()
 
@@ -281,8 +280,18 @@ def _worker(self):
                 if not self._running:
                     return
                 force = self._force_trigger
-                self._cycle_requested = False
                 self._force_trigger = False
+                cycle_requested = self._cycle_requested
+                self._cycle_requested = False
+
+                if not force and not cycle_requested:
+                    wait_seconds = self._compute_wait_seconds_locked(self.clock_fn())
+                    if wait_seconds is None:
+                        self._lock.wait()
+                        continue
+                    if wait_seconds > 0:
+                        self._lock.wait(wait_seconds)
+                        continue
 
             attempt_count = self._run_cycle(force=force)
 
@@ -291,7 +300,7 @@ def _worker(self):
                     return
                 if self._force_trigger or self._cycle_requested:
                     continue
-                wait_seconds = self._compute_wait_seconds(self.clock_fn())
+                wait_seconds = self._compute_wait_seconds_locked(self.clock_fn())
 
                 # Avoid tight loops in cases where nothing was attempted and no wait was computed.
                 if (wait_seconds is not None and wait_seconds <= 0) and attempt_count == 0:
@@ -322,10 +331,12 @@ def _due_window_secs(self) -> float:
 
     def _compute_wait_seconds(self, now: datetime) -> Optional[float]:
         with self._lock:
-            if not self._cache:
-                return None
-            next_ssl_expiry = min(self._cache.values())
+            return self._compute_wait_seconds_locked(now)
 
+    def _compute_wait_seconds_locked(self, now: datetime) -> Optional[float]:
+        if not self._cache:
+            return None
+        next_ssl_expiry = min(self._cache.values())
         remaining_seconds = (next_ssl_expiry - now).total_seconds()
         if remaining_seconds > self.update_threshold_secs:
             return min(

tests/test_renewal_manager.py

@@ -628,6 +628,79 @@ def renewal_callback():
     assert len(client.calls) == 1
 
 
+def test_start_does_not_invoke_callback_without_due_watched_cert():
+    now = datetime(2026, 1, 1, tzinfo=UTC)
+    callback_called = threading.Event()
+
+    mgr = RenewalManager(
+        DummyClient(),
+        renewal_callback=callback_called.set,
+        renew_threshold_days=30,
+        clock_fn=lambda: now,
+    )
+
+    mgr.start()
+    try:
+        assert not callback_called.wait(timeout=0.05)
+    finally:
+        mgr.stop()
+
+
+def test_update_watch_domains_does_not_invoke_callback_for_fresh_cert():
+    now = datetime(2026, 1, 1, tzinfo=UTC)
+    callback_called = threading.Event()
+    client = DummyClient()
+    client.key_store = DummyKeyStore()
+    key = Key.generate("ecdsa")
+    csr = key.create_csr(domain="fresh-callback.example.com", alt_names=["fresh-callback.example.com"])
+    cert_builder = (
+        x509.CertificateBuilder()
+        .subject_name(csr.subject)
+        .issuer_name(x509.Name([x509.NameAttribute(x509.NameOID.COMMON_NAME, "pytest.certapi.local")]))
+        .public_key(csr.public_key())
+        .serial_number(x509.random_serial_number())
+        .not_valid_before(now)
+        .not_valid_after(now + timedelta(days=90))
+    )
+    for ext in csr.extensions:
+        cert_builder = cert_builder.add_extension(ext.value, ext.critical)
+    cert = key.sign_csr(cert_builder)
+    client.key_store.set_domain_cert("fresh-callback.example.com", [cert])
+
+    mgr = RenewalManager(
+        client,
+        renewal_callback=callback_called.set,
+        renew_threshold_days=30,
+        clock_fn=lambda: now,
+    )
+    mgr.start()
+    try:
+        mgr.update_watch_domains(["fresh-callback.example.com"])
+        assert not callback_called.wait(timeout=0.05)
+    finally:
+        mgr.stop()
+
+
+def test_worker_invokes_callback_when_cached_cert_is_due():
+    now = datetime(2026, 1, 1, tzinfo=UTC)
+    callback_called = threading.Event()
+    mgr = RenewalManager(
+        DummyClient(),
+        renewal_callback=callback_called.set,
+        renew_threshold_days=30,
+        clock_fn=lambda: now,
+    )
+    with mgr._lock:
+        mgr._watch_domains = {"due-callback.example.com"}
+        mgr._cache["due-callback.example.com"] = now + timedelta(days=1)
+
+    mgr.start()
+    try:
+        assert callback_called.wait(timeout=2)
+    finally:
+        mgr.stop()
+
+
 def test_running_trigger_now_blocks_until_callback_update_finishes():
     now = datetime(2026, 1, 1, tzinfo=UTC)
     obtain_started = threading.Event()
@@ -768,6 +841,7 @@ def test_stop_does_not_wait_for_hung_remote_request_thread():
         mgr._watch_domains = {"hung.example.com"}
 
     mgr.start()
+    mgr.trigger_now()
     assert started.wait(timeout=2)
     mgr.stop()