[PATCH proxmox] client: clarify error message on mismatching fingerprint further

[PATCH proxmox] client: clarify error message on mismatching fingerprint further

[Shannon Sterz]

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---

Notes:
    ideally we could add more context to the error message exposed to the
    user in the ui, such as the bad fingerprint. sadly it isn't accessible
    at that point anymore so my best attempt at solving this is to
    re-direct users to the syslog where such context can be logged.
    however, that also makes the error message there very verbose for
    something that will get logged every two seconds or so.
    
    since a fix for the rotation case is already in on my to-do list, im
    not sure if this is the best approach. however, im also uncertain what
    else we can do in the short term.

 proxmox-client/src/client.rs | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/proxmox-client/src/client.rs b/proxmox-client/src/client.rs
index 0f014cd5..9cee8ddd 100644
--- a/proxmox-client/src/client.rs
+++ b/proxmox-client/src/client.rs
@@ -556,6 +556,12 @@ fn verify_fingerprint(chain: &x509::X509StoreContextRef, expected_fingerprint: &
     if expected_fingerprint != fp.as_ref() {
         log::error!("bad fingerprint: {}", fp_string(&fp));
         log::error!("expected fingerprint: {}", fp_string(expected_fingerprint));
+        log::error!(
+            r#"If this fingerprint has worked before, it is possible that it changed on the remote
+side. This can happen, for example, if the remote rotates it's certificate regularly.
+If you are sure no machine-in-the-middle attack (MitM) occured, it is safe to set the
+above 'bad fingerpint' as the new fingerprint for the remote."#
+        );
         return false;
     }
 
@@ -588,9 +594,9 @@ fn classify_client_error(err: anyhow::Error) -> Error {
         if let Some(ssl_err) = cause.downcast_ref::<openssl::error::ErrorStack>() {
             return Error::Connect(
                 format!(
-                    "Could not establish a TLS connection. Check \
-                    whether the fingerprint matches or the certificate is valid. \
-                    OpenSSL Error: {ssl_err}"
+                    "Could not establish a TLS connection. Check whether the fingerprint matches or \
+                    the certificate on the remote is valid. The system log might also contain more \
+                    information. OpenSSL Error: {ssl_err}"
                 )
                 .into(),
             );
-- 
2.47.3