Re: [PATCH proxmox-backup v3 4/6] pbs-client: use proxmox-https openssl callback

["Shannon Sterz" <s.sterz@proxmox.com>]

On Wed Jun 17, 2026 at 10:59 AM CEST, Dominik Csapak wrote:
> instead of implementing it here. This changes the behavior when giving a
> fingerprint explicitly when the certificate chain is trusted by openssl.
> Previously this would be accepted due to openssls checks, regardless if
> the given fingerprint would match or not.
>
> With this patch, a given fingerprint has higher priority than openssls
> validation.
>
> Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>

-->8 snip 8<--

> @@ -425,30 +422,42 @@ impl HttpClient {
>              let interactive = options.interactive;
>              let fingerprint_cache = options.fingerprint_cache;
>              let prefix = options.prefix.clone();
> -            let trust_openssl_valid = Arc::new(Mutex::new(true));
>              ssl_connector_builder.set_verify_callback(
>                  openssl::ssl::SslVerifyMode::PEER,
> -                move |valid, ctx| match Self::verify_callback(
> +                move |valid, ctx| match openssl_verify_callback(
>                      valid,
>                      ctx,
> -                    expected_fingerprint.as_ref(),
> -                    interactive,
> -                    Arc::clone(&trust_openssl_valid),
> +                    expected_fingerprint.as_deref(),
>                  ) {
> -                    Ok(None) => true,
> -                    Ok(Some(fingerprint)) => {
> -                        if fingerprint_cache {
> -                            if let Some(ref prefix) = prefix {
> -                                if let Err(err) = store_fingerprint(prefix, &server, &fingerprint) {
> -                                    error!("{}", err);
> +                    Ok(()) => true,
> +                    Err(err) => {
> +                        match err {
> +                            SslVerifyError::NoCertificate => error!(
> +                                "certificate validation failed - context lacks current certificate"

tiny nit, i think a user is likely to misunderstand what "context" here
means and might try to add a given certificate to the system's trust
store. as they might assume that's the context referenced here. imo
something like "certificate validation failed - could not get a
certificate needed for validation from the server" might be clearer?

-->8 snip 8<--