mORMot Open Source

lfyey121 is right.

This "chart" shows when the value of cc.getNotAfter-fRenewBeforeEndDays < NowUtc changes, and works as expected

     FALSE  FALSE  FALSE  >|<  TRUE  TRUE  TRUE  TRUE  TRUE  TRUE 
---------------------------|----------------------------|--------------
                GetNotAfter-fRenewBeforeEndDays     GetNotAfter       
 NowUtc -->
---------------------------|----------------------------|--------------

The previous expression is equivalent to: cc.getNotAfter < NowUtc+fRenewBeforeEndDays

In actual code a expired value is precaltulated before entring the loop, and then the renewal of each certificate is checked with cc.GetNotAfter < expired, so line 1154 should be:

   expired := NowUtc + fRenewBeforeEndDays;