Re: [PATCH proxmox v3 3/6] client: use proxmox-http's openssl verification callback

["Shannon Sterz" <s.sterz@proxmox.com>]

On Wed Jun 17, 2026 at 10:59 AM CEST, Dominik Csapak wrote:
> This changes the validation logic by always checking the fingerprint of
> the leaf certificate, ignoring the openssl verification if a fingerprint
> is configured. This now aligns with our perl implementation and the one
> for proxmox-websocket-tunnel.
>
> Before, a valid certificate chain would have precedence over an explicit
> fingerprint.
>
> Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
> ---
>  proxmox-client/Cargo.toml    |  2 +-
>  proxmox-client/src/client.rs | 69 +++++++++++++-----------------------
>  2 files changed, 25 insertions(+), 46 deletions(-)
>
> diff --git a/proxmox-client/Cargo.toml b/proxmox-client/Cargo.toml
> index 6ca33420..5cbcecd8 100644
> --- a/proxmox-client/Cargo.toml
> +++ b/proxmox-client/Cargo.toml
> @@ -25,7 +25,7 @@ openssl = { workspace = true, optional = true }
>
>  proxmox-login = { workspace = true, features = [ "http" ] }
>
> -proxmox-http = { workspace = true, optional = true, features = [ "client" ] }
> +proxmox-http = { workspace = true, optional = true, features = [ "client", "tls" ] }
>  hyper = { workspace = true, optional = true }
>  hyper-util = { workspace = true, optional = true, features = [ "client-legacy" ] }
>
> diff --git a/proxmox-client/src/client.rs b/proxmox-client/src/client.rs
> index 26913dbb..1a1d3fa8 100644
> --- a/proxmox-client/src/client.rs
> +++ b/proxmox-client/src/client.rs
> @@ -12,6 +12,8 @@ use http_body_util::BodyExt;
>  use openssl::hash::MessageDigest;
>  use openssl::ssl::{SslConnector, SslMethod, SslVerifyMode};
>  use openssl::x509::{self, X509};
> +use proxmox_http::SslVerifyError;
> +use proxmox_http::get_fingerprint_from_u8;
>  use proxmox_login::Ticket;
>  use serde::Serialize;
>
> @@ -110,10 +112,29 @@ impl Client {
>              TlsOptions::Insecure => connector.set_verify(SslVerifyMode::NONE),
>              TlsOptions::Fingerprint(expected_fingerprint) => {
>                  connector.set_verify_callback(SslVerifyMode::PEER, move |valid, chain| {
> -                    if valid {
> -                        return true;
> +                    let fp = get_fingerprint_from_u8(&expected_fingerprint);
> +                    match proxmox_http::openssl_verify_callback(valid, chain, Some(&fp)) {
> +                        Ok(()) => true,
> +                        Err(err) => {
> +                            match err {
> +                                SslVerifyError::FingerprintMismatch {
> +                                    fingerprint,
> +                                    expected,
> +                                } => {
> +                                    log::error!("bad fingerprint: {fingerprint}");
> +                                    log::error!("expected fingerprint: {expected}");
> +                                    log::error!(
> +                                        r#"If this fingerprint has worked before, it is possible that it changed on the remote
> +side. This can happen, for example, if the remote rotates it's certificate regularly.

pre-existing nit (and i think my fault, sorry), but /it's/its/

-->8 snip 8<--