Add certificates ari command to query RFC 9773 renewal information

Welcome

• Yes, I'm using a binary release or the library within the two latest releases.
• Yes, I've searched for similar issues on GitHub and didn't find any.

Detailed Description

Problem

Lego already uses the ARI (renewalInfo) endpoint internally during certificate renewal, but there is no CLI command to query renewal information for an existing certificate.

This makes it difficult to debug or validate ARI integration with a CA (for example, verifying that a certificate is registered and retrieving its suggested renewal window).

Proposed solution

Add a new command:

lego certificates ari --server <acme-directory-url> --cert <certificate.pem> [--json]

Behavior:

• Fetch the ACME directory and resolve the renewalInfo endpoint automatically
• Build the RFC 9773 CertID from the provided certificate
• Query renewal information and display it in the same list-style text format used by certificates list
• Support --json output
• Return clear ACME error details on failure (e.g. certificate not found)

Use case

Testing/debugging ARI against a CA before or after renewal, without triggering an actual certificate renewal.

Notes

This is a read-only query command; it does not modify certificates or accounts.

Implementation and tests are ready in my personal fork if maintainers are interested after issue approval.

Effective version of lego

5.2.2

How do you use lego?

Binary

In which context are you using lego?

Personal and professional use

Supporting the Maintainers

• Yes, I find this project useful, and I appreciate the work done by the maintainers.
• Yes, I have starred this repository to help others find it.
• Yes, I have sponsored this project to keep the project stable and maintained.

Confirmation

• Yes, I've included all the information above (version, usage, etc.).