Re: [PATCH proxmox-acme 2/2] fix #5978: pem parser: relax parsing of chain entries:

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

On June 9, 2026 3:15 pm, Thomas Ellmenreich wrote:
> Instead of using a custom regex to parse pem chains, now uses
> the pve-common Certificate::check_pem function to do so. This
> now allows for additional text and whitespace inbetween the
> chain entries.
> 
> Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
> ---
>  src/PVE/ACME.pm | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
> index e6fb9c2..ff10c22 100644
> --- a/src/PVE/ACME.pm
> +++ b/src/PVE/ACME.pm
> @@ -530,9 +530,11 @@ sub get_certificate {
>                  if !defined($res);
>          }
>  
> -        if ($res =~ /^(-----BEGIN CERTIFICATE-----)(.+)(-----END CERTIFICATE-----)$/s) { # untaint
> -            return $1 . $2 . $3;
> -        }
> +        my $checked = PVE::Certificate::check_pem->($res, no_err => 1);

no_err is actually noerr in PVE::Certificate, so setting it this way has
no effect. but I don't think we need to set it here at all, we can
simply do

return PVE::Certificate::check_pem($res);

it will either die (with a hopefully meaningful error), or return the
cleaned up PEM data.

if you want to customize the error message, something like

my $res = eval { ... };
die "Server reply does not look like a PEM encoded certificate: $@\n"
  if $@;

return $res;

would be a common pattern we use in our code. eval {} is similar to
try/catch in other languages, if the code in the body dies with a fatal
error, it is stored in $@ which can be checked after.

setting noerr is usually reserved for parsing where an error is not
fatal. e.g. if we wanted to parse the data here with multiple possible
labels, we might set noerr for each attempt and only die with an error
if we find no label.

> +        if (defined $checked) {
> +            return $checked;
> +        } 

nit the last line here has trailing whitespace (you can configure your
editor or git to make this more obvious, e.g. mark it as red)

> +
>          die "Server reply does not look like a PEM encoded certificate\n";
>      };
>      $self->fatal("POST of '$order->{certificate}' failed - $@", $r) if $@;
> -- 
> 2.47.3
> 
> 
> 
> 
> 
>