is a self signed certificate always invalid the first time

[Joseph Tam]

> Obviously you do not use clustered environments with more than one node
> per service.  Else you would not call it "it just works", because in
> fact the renewal is quite big bs as one node must do the job while all
> the others must be _offline_.

I'm not sure how you have set up your clustered service, but why do
your nodes have to go offline?  If these other nodes are using an older
certificate, it should still work as the previous/renewed certificate
usually have overlapping active begin/expiration dates.

Joseph Tam <jtam.home at gmail.com>