Re: [PATCH proxmox-acme v2 2/2] fix #5978: pem parser: relax parsing of chain entries:

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

Reviewed-by: Fabian Grünbichler

(once patch #1 has the feedback adressed)

On June 17, 2026 2:42 pm, Thomas Ellmenreich wrote:
> Instead of using a custom regex to parse pem chains, now uses
> the pve-common Certificate::check_pem function to do so. This
> now allows for additional text and whitespace inbetween the
> chain entries.
> 
> Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
> ---
>  src/PVE/ACME.pm | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
> index e6fb9c2..4b06817 100644
> --- a/src/PVE/ACME.pm
> +++ b/src/PVE/ACME.pm
> @@ -530,10 +530,10 @@ sub get_certificate {
>                  if !defined($res);
>          }
>  
> -        if ($res =~ /^(-----BEGIN CERTIFICATE-----)(.+)(-----END CERTIFICATE-----)$/s) { # untaint
> -            return $1 . $2 . $3;
> -        }
> -        die "Server reply does not look like a PEM encoded certificate\n";
> +        my $parsed = eval { PVE::Certificate::check_pem->($res) };
> +        die "Server reply does not look like a PEM encoded certificate: $@\n"
> +            if $@;
> +        return $parsed;
>      };
>      $self->fatal("POST of '$order->{certificate}' failed - $@", $r) if $@;
>      return $return;
> -- 
> 2.47.3
> 
> 
> 
> 
> 
>