From 87f7495534c7a6e064e37711a7066cd9d5655627 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Thu, 19 Mar 2026 09:43:18 +0100
Subject: [PATCH] check-certificates: try renew with common-name or
 subject-alt-name only

One of these is required to assemble the url.
---
 check-certificates.rsc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/check-certificates.rsc b/check-certificates.rsc
index e5683514..194247c6 100644
--- a/check-certificates.rsc
+++ b/check-certificates.rsc
@@ -164,7 +164,8 @@
   }
   $WaitFullyConnected;
 
-  :foreach Cert in=[ /certificate/find where !revoked !ca !scep-url expires-after<$CertRenewTime ] do={
+  :foreach Cert in=[ /certificate/find where !revoked !ca !scep-url expires-after<$CertRenewTime \
+                     (common-name or subject-alt-name) ] do={
     :local CertVal [ /certificate/get $Cert ];
     :local LastName;
     :local FetchName;