Re: [PATCH proxmox 01/11] acme-api: make self-signed certificate expiry configurable

["Lukas Wagner" <l.wagner@proxmox.com>]

Hi Shannon,

thanks for the patch. Some notes inline.

On Thu Jun 18, 2026 at 1:54 PM CEST, Shannon Sterz wrote:
> and change the default from 365000 days (almost 1000 years) to  3650
> days (almost 10 years). almost 1000 years is excessive, as no
> practical cryptographic key can reasonably be considered safe for that
> amount of time. almost 10 years should still give plenty of time to
> prepare for certificate changes.
>
> Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
> ---
>
> Notes:
>     imo, we could go down even more. as far as i am aware there is no real
>     limit that is being enforced here for self-signed certificates from a
>     browser perspective. they are already trusted on an exemption-basis
>     anyway. however, certificates signed by public CAs will only be valid
>     for a maximum of 47 days by 2029 [1].
>     
>     hence, i would personally either adopt the same limit or go down to a
>     year, as a sensible middle-ground. certificate rotation should really
>     be automated even in self-signed scenarios. we also had cases in the
>     past, where customers already ran into issue because they wanted to
>     limit the lifetime of their certificates below 30 days [2]. meaning
>     that there is a need out there for shorter lived certificates (though,
>     in that case a custom CA & ACME setup was used).
>     
>     [1]: https://github.com/cabforum/servercert/pull/553
>     [2]: https://bugzilla.proxmox.com/show_bug.cgi?id=6372
>
>  proxmox-acme-api/src/certificate_helpers.rs | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/proxmox-acme-api/src/certificate_helpers.rs b/proxmox-acme-api/src/certificate_helpers.rs
> index 3921b18e..9c55d30e 100644
> --- a/proxmox-acme-api/src/certificate_helpers.rs
> +++ b/proxmox-acme-api/src/certificate_helpers.rs

Please use this opportunity to add a doc-string for this function which
also documents this new parameter.

> @@ -214,6 +214,7 @@ pub fn create_self_signed_cert(
>      product_name: &str,
>      nodename: &str,
>      domain: Option<&str>,
> +    expire: Option<u32>,

Maybe change the name in such a way that it's clear that this is
  - a duration (not a timestamp)
  - measured in days

e.g. `expiry_in_days` (there might be better choices)

Maybe it would even be a good idea to use the 'Duration' type here? I
guess then the name could stay the same, since the type encodes the
semantics quite nicely.

Duration::from_days is still only in nightly, so instantiating it via
Duration::from_secs for now is a bit awkward for this situation,
admittedly.

https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.from_days

>  ) -> Result<(PKey<Private>, X509), Error> {
>      let rsa = Rsa::generate(4096).unwrap();
>  
> @@ -223,7 +224,7 @@ pub fn create_self_signed_cert(
>  
>      let today = openssl::asn1::Asn1Time::days_from_now(0)?;
>      x509.set_not_before(&today)?;
> -    let expire = openssl::asn1::Asn1Time::days_from_now(365 * 1000)?;
> +    let expire = openssl::asn1::Asn1Time::days_from_now(expire.unwrap_or(365 * 10))?;
>      x509.set_not_after(&expire)?;
>  
>      let mut fqdn = nodename.to_owned();


Also would not hurt to use this opportunity to implement a simple
unit-test for this function, which (at least) tests that the expiry is
set correctly. I think this crate should already have all the needed
helpers to parse and verify the generated cert in a test?