[PATCH proxmox v3 02/16] tls-certificates: add days_valid parameter to create_self_signed_cert

[Shannon Sterz <s.sterz@proxmox.com>]

to allow specifying how long a certificate should be valid for. also
adds unit tests to verify this behavior.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---

Notes:
    imo, we could go down even more. as far as i am aware there is no real
    limit that is being enforced here for self-signed certificates from a
    browser perspective. they are already trusted on an exemption-basis
    anyway. however, certificates signed by public CAs will only be valid
    for a maximum of 47 days by 2029 [1].
    
    hence, i would personally either adopt the same limit or go down to a
    year, as a sensible middle-ground. certificate rotation should really
    be automated even in self-signed scenarios. we also had cases in the
    past, where customers already ran into an issue because they wanted to
    limit the lifetime of their certificates below 30 days [2]. meaning
    that there is a need out there for shorter-lived certificates (though,
    in that case a custom CA & ACME setup was used).
    
    [1]: https://github.com/cabforum/servercert/pull/553
    [2]: https://bugzilla.proxmox.com/show_bug.cgi?id=6372

 proxmox-tls-certificates/src/util.rs | 132 ++++++++++++++++++++++++++-
 1 file changed, 131 insertions(+), 1 deletion(-)

diff --git a/proxmox-tls-certificates/src/util.rs b/proxmox-tls-certificates/src/util.rs
index 346872ac..98aa042e 100644
--- a/proxmox-tls-certificates/src/util.rs
+++ b/proxmox-tls-certificates/src/util.rs
@@ -15,10 +15,13 @@ use crate::CertificateInfo;
 ///   subject alternative names will be set based on this value.
 /// * `domain`: The optional domain which the node is in. If set, it will be appended to `nodename`
 ///   to derive an FQDN as common and subject alternative name.
+/// * `days_valid`: The optional number of days that the certificate should be valid for. If not
+///   set, the certificate will be valid for 3650 days, almost ten years.
 pub fn create_self_signed_cert(
     product_name: &str,
     nodename: &str,
     domain: Option<&str>,
+    days_valid: Option<u32>,
 ) -> Result<(PKey<Private>, X509), Error> {
     let rsa = Rsa::generate(4096).unwrap();
 
@@ -28,7 +31,7 @@ pub fn create_self_signed_cert(
 
     let today = openssl::asn1::Asn1Time::days_from_now(0)?;
     x509.set_not_before(&today)?;
-    let expire = openssl::asn1::Asn1Time::days_from_now(365 * 10)?;
+    let expire = openssl::asn1::Asn1Time::days_from_now(days_valid.unwrap_or(365 * 10))?;
     x509.set_not_after(&expire)?;
 
     let mut fqdn = nodename.to_owned();
@@ -207,3 +210,130 @@ fn asn1_time_to_unix(time: &openssl::asn1::Asn1TimeRef) -> Result<i64, Error> {
     let mut c_tm = unsafe { c_tm.assume_init() };
     proxmox_time::timegm(&mut c_tm)
 }
+
+#[cfg(test)]
+mod test {
+    use super::*;
+
+    fn get_self_signed_certificate_info(
+        product_name: &str,
+        nodename: &str,
+        domain: Option<&str>,
+        days_valid: Option<u32>,
+    ) -> CertificateInfo {
+        let cert = match create_self_signed_cert(product_name, nodename, domain, days_valid) {
+            Ok((_priv_key, certificate)) => certificate,
+            Err(e) => panic!("could not create self signed certificate - {e}"),
+        };
+
+        let pem_bytes = match cert.to_pem() {
+            Ok(pem) => pem,
+            Err(e) => panic!("could not get pem bytes from signed certificate - {e}"),
+        };
+
+        match CertificateInfo::from_pem("", &pem_bytes) {
+            Ok(cert_info) => cert_info,
+            Err(e) => panic!("could not parse cert pem to cert info - {e}"),
+        }
+    }
+
+    #[test]
+    fn self_signed_certificate_correct_with_product_and_name_only() {
+        let cert_info =
+            get_self_signed_certificate_info("Proxmox Test Product", "name", None, None);
+
+        assert!(cert_info.subject.contains("O = Proxmox Test Product"));
+        assert!(cert_info.subject.contains("CN = name"));
+        assert_eq!(
+            cert_info.san,
+            vec![
+                "IP: [127, 0, 0, 1]",
+                "IP: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]",
+                "DNS: localhost",
+                "DNS: name"
+            ]
+        );
+    }
+
+    #[test]
+    fn self_signed_certificate_correct_with_domain() {
+        let cert_info =
+            get_self_signed_certificate_info("Proxmox Test Product", "name", Some("fqdn"), None);
+
+        assert!(cert_info.subject.contains("O = Proxmox Test Product"));
+        assert!(cert_info.subject.contains("CN = name.fqdn"));
+        assert_eq!(
+            cert_info.san,
+            vec![
+                "IP: [127, 0, 0, 1]",
+                "IP: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]",
+                "DNS: localhost",
+                "DNS: name",
+                "DNS: name.fqdn"
+            ]
+        );
+    }
+
+    #[test]
+    fn self_signed_certificate_correct_with_days_valid() {
+        let in_two_days = proxmox_time::epoch_i64() + 2 * 24 * 60 * 60;
+        let cert_info =
+            get_self_signed_certificate_info("Proxmox Test Product", "name", None, Some(2));
+
+        assert!(
+            cert_info
+                .notafter
+                .map(|a| a >= in_two_days)
+                .unwrap_or_default()
+        );
+        assert!(
+            cert_info
+                .notafter
+                .map(|a| a < in_two_days + 24 * 60 * 60)
+                .unwrap_or_default()
+        );
+        assert!(cert_info.subject.contains("O = Proxmox Test Product"));
+        assert!(cert_info.subject.contains("CN = name"));
+        assert_eq!(
+            cert_info.san,
+            vec![
+                "IP: [127, 0, 0, 1]",
+                "IP: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]",
+                "DNS: localhost",
+                "DNS: name",
+            ]
+        );
+    }
+
+    #[test]
+    fn self_signed_certificate_correct_with_domain_and_days_valid() {
+        let in_two_days = proxmox_time::epoch_i64() + 2 * 24 * 60 * 60;
+        let cert_info =
+            get_self_signed_certificate_info("Proxmox Test Product", "name", Some("fqdn"), Some(2));
+
+        assert!(
+            cert_info
+                .notafter
+                .map(|a| a >= in_two_days)
+                .unwrap_or_default()
+        );
+        assert!(
+            cert_info
+                .notafter
+                .map(|a| a < in_two_days + 24 * 60 * 60)
+                .unwrap_or_default()
+        );
+        assert!(cert_info.subject.contains("O = Proxmox Test Product"));
+        assert!(cert_info.subject.contains("CN = name.fqdn"));
+        assert_eq!(
+            cert_info.san,
+            vec![
+                "IP: [127, 0, 0, 1]",
+                "IP: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]",
+                "DNS: localhost",
+                "DNS: name",
+                "DNS: name.fqdn"
+            ]
+        );
+    }
+}
-- 
2.47.3