From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id ACB8A1FF0F1 for ; Thu, 30 Jul 2026 15:32:18 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 53E3621564; Thu, 30 Jul 2026 15:32:08 +0200 (CEST) From: Shannon Sterz To: pbs-devel@lists.proxmox.com Subject: [PATCH datacenter-manager/proxmox{,-backup} 00/16] TLS Certificate Rotation Date: Thu, 30 Jul 2026 15:31:42 +0200 Message-ID: <20260730133158.418015-1-s.sterz@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1785418312763 X-SPAM-LEVEL: Spam detection results: 1 AWL -1.394 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLACK 3 Contains an URL listed in the URIBL blacklist [types.rs] Message-ID-Hash: M42K6XOPONT2G75HB4NZHBAQG6E23XND X-Message-ID-Hash: M42K6XOPONT2G75HB4NZHBAQG6E23XND X-MailFrom: s.sterz@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: this series adds certificate rotation to Proxmox Backup Server and Proxmox Datacenter Manager. currently, both products issue a certificate that is valid for almost 1000 years (365000 days). no cryptographic key can reasonably be considered secure for this amount of time. this series: - allows specifying the lifetime of the certificate when creating one via proxmox-acme-api and reduces the default to 3650 days (almost ten years). - sends and logs reminders 30 days before a certificate expires (pdm currently does not support the notification framework yet, so adding notifications is left as future work here). - refreshes a certificate at the earliest 15 days before it expires, logs and notifies when that happens. - warns on certificates with excessive lifetimes (>3650 days) and documents how to manually update them. - for pdm: exposes cert handling cli methods in proxmox-datacenter-manager-admin. - fixes up some inconsistencies in the ui and docs in regards to pdm's certificate location. - adjusts the severity of acme renewal error notifications for pbs ## Testing the easiest way to test this is to manipulate the date of the host with `date --set` and then manually trigger the daily update binary for each product: * PBS: `/usr/lib/x86_64-linux-gnu/proxmox-backup/proxmox-daily-update` * PDM: `/usr/libexec/proxmox/proxmox-datacenter-manager-daily-update` you can then check the logs and the certificate itself to see what happened. specifying the `PBS_LOG` environment variable with the parameter `trace` or `debug` will also enable debug logging here. ## Open Questions + 10 years is still a long time and i'd rather reduce that further down if possible. see the patch 02 for proxmox-tls-certificates for more info. + should we remove pre-existing long lasting certificates by ourselves? imo that is too risky at the moment given that an unplanned certificate rotation could cause backups to fail. + notifying every day for 15 days before the renewal might be excessive, see the second commit for pbs. ## Future Work - pve and pdm should be extended to allow automatically updating allowed fingerprints before a new self-signed certificate goes into action. a series demonstrating this for pve<->pdm has already been sent [1]. if this series gets approved, i'll happily adapt the mechanism for pbs<->pve and pbs<->pdm. - pdm should send notifications similar to pbs once support for notifications is added. ## Changelog * v1: https://lore.proxmox.com/pbs-devel/20260422124022.17952-1-s.sterz@proxmox.com/ changes since v1 (thanks @ Lukas Wagner): + dropped a patch for proxmox-yew-comp that got applied already + rebased on current master for all three repos + created new `proxmox-tls-certificates` crate and moved several helpers there. reexposing functions in proxmox-acme-api to avoid breakage. + added unit tests and more documentation to tls helpers + adjusted the severity of error and renewal notifications + adapted the upcoming renewal template for pbs to inform about the earliest data a renewal could happen * rfc: https://lore.proxmox.com/pbs-devel/20260407135714.490747-1-s.sterz@proxmox.com/ changes since rfc: + add patches that avoid hard-coding the certificate file name in yew-comp and use the proper filename in pdm + update pdm renewal docs patch to avoid confusion + re-base on current master [1]: https://lore.proxmox.com/pdm-devel/20260611120327.257523-1-s.sterz@proxmox.com/ proxmox: Shannon Sterz (4): acme-api/tls-certificates: add new crate collecting tls realted helpers tls-certificates: add days_valid parameter to create_self_signed_cert tls-certificates: add self_signed_cert_expires_in to check certificates acme-api: stop re-exporting create_self_signed_cert Cargo.toml | 2 + proxmox-acme-api/Cargo.toml | 2 + proxmox-acme-api/src/certificate_helpers.rs | 195 ---------- proxmox-acme-api/src/lib.rs | 2 +- proxmox-acme-api/src/types.rs | 51 +-- proxmox-tls-certificates/Cargo.toml | 41 ++ proxmox-tls-certificates/src/lib.rs | 7 + proxmox-tls-certificates/src/types.rs | 54 +++ proxmox-tls-certificates/src/util.rs | 395 ++++++++++++++++++++ 9 files changed, 503 insertions(+), 246 deletions(-) create mode 100644 proxmox-tls-certificates/Cargo.toml create mode 100644 proxmox-tls-certificates/src/lib.rs create mode 100644 proxmox-tls-certificates/src/types.rs create mode 100644 proxmox-tls-certificates/src/util.rs backup: Shannon Sterz (6): config: use proxmox_tls_certificates for generating self-signed certificates config/server/api: add certificate renewal logic including notifications daily update: warn about excessive self-signed certificate lifetime docs: document force refreshing long-lived certificates backup-manager cli: `cert update` can create auth and csrf key notifications: use `Severity::Error` for acme renewal failures Cargo.toml | 3 + debian/control | 2 + debian/proxmox-backup-server.install | 6 ++ docs/certificate-management.rst | 31 ++++++ src/api2/node/certificates.rs | 9 +- src/bin/proxmox-daily-update.rs | 43 ++++++++- src/bin/proxmox_backup_manager/cert.rs | 2 + src/config/mod.rs | 96 ++----------------- src/server/notifications/mod.rs | 58 ++++++++++- src/server/notifications/template_data.rs | 11 +++ templates/Makefile | 68 +++++++------ templates/default/cert-err-body.txt.hbs | 7 ++ templates/default/cert-err-subject.txt.hbs | 1 + templates/default/cert-refresh-body.txt.hbs | 8 ++ .../default/cert-refresh-subject.txt.hbs | 1 + .../cert-upcoming-refresh-body.txt.hbs | 10 ++ .../cert-upcoming-refresh-subject.txt.hbs | 1 + 17 files changed, 237 insertions(+), 120 deletions(-) create mode 100644 templates/default/cert-err-body.txt.hbs create mode 100644 templates/default/cert-err-subject.txt.hbs create mode 100644 templates/default/cert-refresh-body.txt.hbs create mode 100644 templates/default/cert-refresh-subject.txt.hbs create mode 100644 templates/default/cert-upcoming-refresh-body.txt.hbs create mode 100644 templates/default/cert-upcoming-refresh-subject.txt.hbs datacenter-manager: Shannon Sterz (6): certs: use proxmox-tls-certificates directly, add days_valid paramter api/auth/bin: add certificate renewal logic cli: expose certificate management endpoints via the cli daily-update: warn about certificates with excessive lifetimes docs: add section on forcing a new self-signed certificate docs/certificates: use correct certificate file name Cargo.toml | 2 + cli/admin/Cargo.toml | 2 + cli/admin/src/cert.rs | 86 +++++++++++++++++++ cli/admin/src/main.rs | 2 + debian/control | 2 + docs/certificate-management.rst | 32 +++++++ server/Cargo.toml | 1 + server/src/api/nodes/certificates.rs | 19 ++-- server/src/auth/certs.rs | 19 +++- ...proxmox-datacenter-manager-daily-update.rs | 38 ++++++++ 10 files changed, 190 insertions(+), 13 deletions(-) create mode 100644 cli/admin/src/cert.rs Summary over all repositories: 36 files changed, 930 insertions(+), 379 deletions(-) -- Generated by murpp 0.12.0