From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <d.jaeger@proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 key-exchange X25519 server-signature RSA-PSS (2048 bits))
 (No client certificate requested)
 by lists.proxmox.com (Postfix) with ESMTPS id EAF3174DD0
 for <pbs-devel@lists.proxmox.com>; Tue, 20 Apr 2021 12:27:41 +0200 (CEST)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
 by firstgate.proxmox.com (Proxmox) with ESMTP id D7ED821BDF
 for <pbs-devel@lists.proxmox.com>; Tue, 20 Apr 2021 12:27:11 +0200 (CEST)
Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com
 [212.186.127.180])
 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
 (No client certificate requested)
 by firstgate.proxmox.com (Proxmox) with ESMTPS id 669C921BD4
 for <pbs-devel@lists.proxmox.com>; Tue, 20 Apr 2021 12:27:07 +0200 (CEST)
Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1])
 by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 33EC6425AE
 for <pbs-devel@lists.proxmox.com>; Tue, 20 Apr 2021 12:27:07 +0200 (CEST)
Date: Tue, 20 Apr 2021 12:27:05 +0200
From: Dominic =?iso-8859-1?Q?J=E4ger?= <d.jaeger@proxmox.com>
To: Proxmox Backup Server development discussion <pbs-devel@lists.proxmox.com>, 
 Wolfgang Bumiller <w.bumiller@proxmox.com>
Message-ID: <20210420102705.GA501235@mala>
References: <20210416133517.23349-1-w.bumiller@proxmox.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20210416133517.23349-1-w.bumiller@proxmox.com>
User-Agent: Mutt/1.10.1 (2018-07-13)
X-SPAM-LEVEL: Spam detection results:  0
 AWL 1.572 Adjusted score from AWL reputation of From: address
 KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
 RCVD_IN_DNSWL_MED        -2.3 Sender listed at https://www.dnswl.org/,
 medium trust
 SPF_HELO_NONE           0.001 SPF: HELO does not publish an SPF Record
 SPF_PASS               -0.001 SPF: sender matches SPF record
Subject: Re: [pbs-devel] [RFC backup 00/23] Implements ACME suport for PBS
X-BeenThere: pbs-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox Backup Server development discussion
 <pbs-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pbs-devel>, 
 <mailto:pbs-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pbs-devel/>
List-Post: <mailto:pbs-devel@lists.proxmox.com>
List-Help: <mailto:pbs-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel>, 
 <mailto:pbs-devel-request@lists.proxmox.com?subject=subscribe>
X-List-Received-Date: Tue, 20 Apr 2021 10:27:42 -0000

Creating the first account gives missing directory
> TASK ERROR: failed to open "/etc/proxmox-backup/acme/accounts/test" for
> writing: No such file or directory (os error 2)
After manually adding it, the HTTP Challenged worked for me.

In the Window "Add: ACME DNS Plugin" choosing (or writing) something in the
dropdown menu DNS API is not possible with only the PBS repositories
configured.  It is necessary to install libproxmox-acme-perl from PVE
repositories in addition.

Deleting a certificate shows a confirmation dialog with a truncated message:
"Are you sure you want to remove the certificate used for"

In the window "Register Account" the textfield "Account Name" has the empty
text "default".  As far as I know, we use empty texts for real default values.
So this should be removed and get a validator (already in the GUI) instead.
But the API rejects correctly: "parameter verification errors parameter 'name':
parameter is missing and it is not optional."

Registering accounts for both staging and production works.  Ordering
certificates with HTTP challenge generally works for both, too.  A few times
the HTTP challenge required a manual retry. Maybe we could do something like
increasing timeouts?

I couldn't set up PowerDNS yet & my domains were not fast enough, so finishing
the DNS challenge testing remains todo.

Tested-by: Dominic Jäger <d.jaeger@proxmox.com>