From: "Lukas Wagner" <l.wagner@proxmox.com>
To: "Proxmox Datacenter Manager development discussion"
<pdm-devel@lists.proxmox.com>,
"Shannon Sterz" <s.sterz@proxmox.com>
Subject: [pdm-devel] applied: [PATCH proxmox] client: handle tls verification errors more gracefully
Date: Wed, 03 Dec 2025 11:53:15 +0100 [thread overview]
Message-ID: <DEOIXAFCN6V2.2DZHLI4MNL719@proxmox.com> (raw)
In-Reply-To: <20251202112235.215074-2-s.sterz@proxmox.com>
On Tue Dec 2, 2025 at 12:22 PM CET, Shannon Sterz wrote:
> this makes it so that errors that previously would simply yield a
> "client error (Connect)" now show a more useful error message, such
> as:
>
> Could not establish a TLS connection. Check whether the fingerprint
> matches or the certificate is valid. OpenSSL Error: error:0A000086:SSL
> routines:tls_post_process_server_certificate:certificate verify
> failed:../ssl/statem/statem_clnt.c:2123:
>
> this should help users figure out what's really happened more easily.
>
> Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
> ---
> there might also be one or two bugs hiding in how the client handles
> certificate validation. imo setting a fingerprint should override
> certificate validity and not the other way round. as it is somewhat akin
> to pinning a certificate.
>
> also as fabian pointed out in an off list discussion, the use of
> `current_cert` in `verify_fingerprint` may be wrong as it could yield a
> parent certificate if it is already unverifiable by openssl. this one
> would need some more investigation, though.
>
> left both of these as-is, as that seems like some bigger changes for
> right now.
>
Just for the record, this was already applied [1].
[1] https://git.proxmox.com/?p=proxmox.git;a=commitdiff;h=0d96b40f3d13653f44d2e56d887bef2b123c4b92
_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel
next prev parent reply other threads:[~2025-12-03 10:53 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-02 11:22 [pdm-devel] " Shannon Sterz
2025-12-03 10:53 ` Lukas Wagner [this message]
2025-12-03 12:22 ` Thomas Lamprecht
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DEOIXAFCN6V2.2DZHLI4MNL719@proxmox.com \
--to=l.wagner@proxmox.com \
--cc=pdm-devel@lists.proxmox.com \
--cc=s.sterz@proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.