all lists on lists.proxmox.com
 help / color / mirror / Atom feed
From: Shannon Sterz <s.sterz@proxmox.com>
To: pbs-devel@lists.proxmox.com
Subject: [PATCH datacenter-manager 11/16] certs: use proxmox-tls-certificates directly, add days_valid paramter
Date: Thu, 30 Jul 2026 15:31:53 +0200	[thread overview]
Message-ID: <20260730133158.418015-12-s.sterz@proxmox.com> (raw)
In-Reply-To: <20260730133158.418015-1-s.sterz@proxmox.com>

instead of using it through proxmox-acme-api. chosing `None` as days
valid parameter makes the certificate valid for 3650 days, almost ten
years.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 Cargo.toml               | 2 ++
 debian/control           | 2 ++
 server/Cargo.toml        | 1 +
 server/src/auth/certs.rs | 3 ++-
 4 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/Cargo.toml b/Cargo.toml
index b5916b36..952a9573 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -66,6 +66,7 @@ proxmox-sys = "1"
 proxmox-systemd = "1"
 proxmox-tfa = { version = "6", features = [ "api-types" ], default-features = false }
 proxmox-time = "2"
+proxmox-tls-certificates = { version = "1", features = [ "impl" ] }
 proxmox-upgrade-checks = "1"
 proxmox-uuid = "1"
 proxmox-installer-types = "0.1"
@@ -184,6 +185,7 @@ zstd = { version = "0.13" }
 # proxmox-tfa = { path = "../proxmox/proxmox-tfa" }
 # proxmox-time-api = { path = "../proxmox/proxmox-time-api" }
 # proxmox-time = { path = "../proxmox/proxmox-time" }
+# proxmox-tls-certificates = { path = "../proxmox/proxmox-tls-certificates" }
 # proxmox-upgrade-checks = { path = "../proxmox/proxmox-upgrade-checks" }
 # proxmox-uuid = { path = "../proxmox/proxmox-uuid" }
 # proxmox-worker-task = { path = "../proxmox/proxmox-worker-task" }
diff --git a/debian/control b/debian/control
index e1430dca..5bd6ef8e 100644
--- a/debian/control
+++ b/debian/control
@@ -111,6 +111,8 @@ Build-Depends: debhelper-compat (= 13),
                librust-proxmox-time-2+default-dev,
                librust-proxmox-time-api-1+default-dev,
                librust-proxmox-time-api-1+impl-dev,
+               librust-proxmox-tls-certificates-1+default-dev,
+               librust-proxmox-tls-certificates-1+impl-dev,
                librust-proxmox-upgrade-checks-1+default-dev,
                librust-proxmox-uuid-1+default-dev,
                librust-pve-api-types-8+client-dev (>= 8.1.12-~~),
diff --git a/server/Cargo.toml b/server/Cargo.toml
index 663f21cb..d70e1d11 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -64,6 +64,7 @@ proxmox-sys = { workspace = true, features = [ "timer" ] }
 proxmox-systemd.workspace = true
 proxmox-tfa = { workspace = true, features = [ "api" ] }
 proxmox-time.workspace = true
+proxmox-tls-certificates = { workspace = true, features = [ "impl" ]}
 proxmox-uuid.workspace = true
 
 proxmox-apt = { workspace = true, features = [ "cache" ] }
diff --git a/server/src/auth/certs.rs b/server/src/auth/certs.rs
index 49b2076b..c208cf4f 100644
--- a/server/src/auth/certs.rs
+++ b/server/src/auth/certs.rs
@@ -19,10 +19,11 @@ pub fn update_self_signed_cert(force: bool) -> Result<(), Error> {
 
     let resolv_conf = read_etc_resolv_conf(None)?.config;
 
-    let (priv_key, cert) = proxmox_acme_api::create_self_signed_cert(
+    let (priv_key, cert) = proxmox_tls_certificates::create_self_signed_cert(
         "Proxmox Datacenter Manager",
         proxmox_sys::nodename(),
         resolv_conf.search.as_deref(),
+        None,
     )?;
 
     let cert_pem = cert.to_pem()?;
-- 
2.47.3





  parent reply	other threads:[~2026-07-30 13:32 UTC|newest]

Thread overview: 18+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-30 13:31 [PATCH datacenter-manager/proxmox{,-backup} 00/16] TLS Certificate Rotation Shannon Sterz
2026-07-30 13:31 ` [PATCH proxmox 01/16] acme-api/tls-certificates: add new crate collecting tls realted helpers Shannon Sterz
2026-07-30 13:31 ` [PATCH proxmox 02/16] tls-certificates: add days_valid parameter to create_self_signed_cert Shannon Sterz
2026-07-30 13:31 ` [PATCH proxmox 03/16] tls-certificates: add self_signed_cert_expires_in to check certificates Shannon Sterz
2026-07-30 13:31 ` [PATCH proxmox 04/16] acme-api: stop re-exporting create_self_signed_cert Shannon Sterz
2026-07-30 13:31 ` [PATCH proxmox-backup 05/16] config: use proxmox_tls_certificates for generating self-signed certificates Shannon Sterz
2026-07-30 13:31 ` [PATCH proxmox-backup 06/16] config/server/api: add certificate renewal logic including notifications Shannon Sterz
2026-07-30 13:31 ` [PATCH proxmox-backup 07/16] daily update: warn about excessive self-signed certificate lifetime Shannon Sterz
2026-07-30 13:31 ` [PATCH proxmox-backup 08/16] docs: document force refreshing long-lived certificates Shannon Sterz
2026-07-30 13:31 ` [PATCH proxmox-backup 09/16] backup-manager cli: `cert update` can create auth and csrf key Shannon Sterz
2026-07-30 13:31 ` [PATCH proxmox-backup 10/16] notifications: use `Severity::Error` for acme renewal failures Shannon Sterz
2026-07-30 13:31 ` Shannon Sterz [this message]
2026-07-30 13:31 ` [PATCH datacenter-manager 12/16] api/auth/bin: add certificate renewal logic Shannon Sterz
2026-07-30 13:31 ` [PATCH datacenter-manager 13/16] cli: expose certificate management endpoints via the cli Shannon Sterz
2026-07-30 13:31 ` [PATCH datacenter-manager 14/16] daily-update: warn about certificates with excessive lifetimes Shannon Sterz
2026-07-30 13:31 ` [PATCH datacenter-manager 15/16] docs: add section on forcing a new self-signed certificate Shannon Sterz
2026-07-30 13:31 ` [PATCH datacenter-manager 16/16] docs/certificates: use correct certificate file name Shannon Sterz
2026-07-30 13:44 ` [PATCH datacenter-manager/proxmox{,-backup} 00/16] TLS Certificate Rotation Shannon Sterz

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260730133158.418015-12-s.sterz@proxmox.com \
    --to=s.sterz@proxmox.com \
    --cc=pbs-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal