Re: [PATCH datacenter-manager/proxmox{,-backup} 00/16] TLS Certificate Rotation

["Shannon Sterz" <s.sterz@proxmox.com>]

Ah sorry, i just noticed that the v2 here is missing. sorry about that.

On Thu Jul 30, 2026 at 3:31 PM CEST, Shannon Sterz wrote:
> this series adds certificate rotation to Proxmox Backup Server and Proxmox
> Datacenter Manager. currently, both products issue a certificate that is valid
> for almost 1000 years (365000 days). no cryptographic key can reasonably be
> considered secure for this amount of time. this series:
>
> - allows specifying the lifetime of the certificate when creating one via
>   proxmox-acme-api and reduces the default to 3650 days (almost ten years).
> - sends and logs reminders 30 days before a certificate expires (pdm currently
>   does not support the notification framework yet, so adding notifications is
>   left as future work here).
> - refreshes a certificate at the earliest 15 days before it expires, logs
>   and notifies when that happens.
> - warns on certificates with excessive lifetimes (>3650 days) and documents
>   how to manually update them.
> - for pdm: exposes cert handling cli methods in proxmox-datacenter-manager-admin.
> - fixes up some inconsistencies in the ui and docs in regards to pdm's
>   certificate location.
> - adjusts the severity of acme renewal error notifications for pbs
>
> ## Testing
>
> the easiest way to test this is to manipulate the date of the host with `date
> --set` and then manually trigger the daily update binary for each product:
>
> * PBS: `/usr/lib/x86_64-linux-gnu/proxmox-backup/proxmox-daily-update`
> * PDM: `/usr/libexec/proxmox/proxmox-datacenter-manager-daily-update`
>
> you can then check the logs and the certificate itself to see what happened.
> specifying the `PBS_LOG` environment variable with the parameter `trace` or
> `debug` will also enable debug logging here.
>
> ## Open Questions
>
> + 10 years is still a long time and i'd rather reduce that further down if
>   possible. see the patch 02 for proxmox-tls-certificates for more info.
> + should we remove pre-existing long lasting certificates by ourselves? imo
>   that is too risky at the moment given that an unplanned certificate rotation
>   could cause backups to fail.
> + notifying every day for 15 days before the renewal might be excessive, see
>   the second commit for pbs.
>
> ## Future Work
>
> - pve and pdm should be extended to allow automatically updating allowed
>   fingerprints before a new self-signed certificate goes into action. a series
>   demonstrating this for pve<->pdm has already been sent [1]. if this series gets
>   approved, i'll happily adapt the mechanism for pbs<->pve and pbs<->pdm.
> - pdm should send notifications similar to pbs once support for notifications
>   is added.
>
> ## Changelog
>
> * v1: https://lore.proxmox.com/pbs-devel/20260422124022.17952-1-s.sterz@proxmox.com/
>
>     changes since v1 (thanks @ Lukas Wagner):
>
>     + dropped a patch for proxmox-yew-comp that got applied already
>     + rebased on current master for all three repos
>     + created new `proxmox-tls-certificates` crate and moved several helpers
>       there. reexposing functions in proxmox-acme-api to avoid breakage.
>     + added unit tests and more documentation to tls helpers
>     + adjusted the severity of error and renewal notifications
>     + adapted the upcoming renewal template for pbs to inform about the
>       earliest data a renewal could happen
>
> * rfc: https://lore.proxmox.com/pbs-devel/20260407135714.490747-1-s.sterz@proxmox.com/
>
>     changes since rfc:
>
>     + add patches that avoid hard-coding the certificate file name in yew-comp
>       and use the proper filename in pdm
>     + update pdm renewal docs patch to avoid confusion
>     + re-base on current master
>
> [1]: https://lore.proxmox.com/pdm-devel/20260611120327.257523-1-s.sterz@proxmox.com/
>
>
> proxmox:
>
> Shannon Sterz (4):
>   acme-api/tls-certificates: add new crate collecting tls realted
>     helpers
>   tls-certificates: add days_valid parameter to create_self_signed_cert
>   tls-certificates: add self_signed_cert_expires_in to check
>     certificates
>   acme-api: stop re-exporting create_self_signed_cert
>
>  Cargo.toml                                  |   2 +
>  proxmox-acme-api/Cargo.toml                 |   2 +
>  proxmox-acme-api/src/certificate_helpers.rs | 195 ----------
>  proxmox-acme-api/src/lib.rs                 |   2 +-
>  proxmox-acme-api/src/types.rs               |  51 +--
>  proxmox-tls-certificates/Cargo.toml         |  41 ++
>  proxmox-tls-certificates/src/lib.rs         |   7 +
>  proxmox-tls-certificates/src/types.rs       |  54 +++
>  proxmox-tls-certificates/src/util.rs        | 395 ++++++++++++++++++++
>  9 files changed, 503 insertions(+), 246 deletions(-)
>  create mode 100644 proxmox-tls-certificates/Cargo.toml
>  create mode 100644 proxmox-tls-certificates/src/lib.rs
>  create mode 100644 proxmox-tls-certificates/src/types.rs
>  create mode 100644 proxmox-tls-certificates/src/util.rs
>
>
> backup:
>
> Shannon Sterz (6):
>   config: use proxmox_tls_certificates for generating self-signed
>     certificates
>   config/server/api: add certificate renewal logic including
>     notifications
>   daily update: warn about excessive self-signed certificate lifetime
>   docs: document force refreshing long-lived certificates
>   backup-manager cli: `cert update` can create auth and csrf key
>   notifications: use `Severity::Error` for acme renewal failures
>
>  Cargo.toml                                    |  3 +
>  debian/control                                |  2 +
>  debian/proxmox-backup-server.install          |  6 ++
>  docs/certificate-management.rst               | 31 ++++++
>  src/api2/node/certificates.rs                 |  9 +-
>  src/bin/proxmox-daily-update.rs               | 43 ++++++++-
>  src/bin/proxmox_backup_manager/cert.rs        |  2 +
>  src/config/mod.rs                             | 96 ++-----------------
>  src/server/notifications/mod.rs               | 58 ++++++++++-
>  src/server/notifications/template_data.rs     | 11 +++
>  templates/Makefile                            | 68 +++++++------
>  templates/default/cert-err-body.txt.hbs       |  7 ++
>  templates/default/cert-err-subject.txt.hbs    |  1 +
>  templates/default/cert-refresh-body.txt.hbs   |  8 ++
>  .../default/cert-refresh-subject.txt.hbs      |  1 +
>  .../cert-upcoming-refresh-body.txt.hbs        | 10 ++
>  .../cert-upcoming-refresh-subject.txt.hbs     |  1 +
>  17 files changed, 237 insertions(+), 120 deletions(-)
>  create mode 100644 templates/default/cert-err-body.txt.hbs
>  create mode 100644 templates/default/cert-err-subject.txt.hbs
>  create mode 100644 templates/default/cert-refresh-body.txt.hbs
>  create mode 100644 templates/default/cert-refresh-subject.txt.hbs
>  create mode 100644 templates/default/cert-upcoming-refresh-body.txt.hbs
>  create mode 100644 templates/default/cert-upcoming-refresh-subject.txt.hbs
>
>
> datacenter-manager:
>
> Shannon Sterz (6):
>   certs: use proxmox-tls-certificates directly, add days_valid paramter
>   api/auth/bin: add certificate renewal logic
>   cli: expose certificate management endpoints via the cli
>   daily-update: warn about certificates with excessive lifetimes
>   docs: add section on forcing a new self-signed certificate
>   docs/certificates: use correct certificate file name
>
>  Cargo.toml                                    |  2 +
>  cli/admin/Cargo.toml                          |  2 +
>  cli/admin/src/cert.rs                         | 86 +++++++++++++++++++
>  cli/admin/src/main.rs                         |  2 +
>  debian/control                                |  2 +
>  docs/certificate-management.rst               | 32 +++++++
>  server/Cargo.toml                             |  1 +
>  server/src/api/nodes/certificates.rs          | 19 ++--
>  server/src/auth/certs.rs                      | 19 +++-
>  ...proxmox-datacenter-manager-daily-update.rs | 38 ++++++++
>  10 files changed, 190 insertions(+), 13 deletions(-)
>  create mode 100644 cli/admin/src/cert.rs
>
>
> Summary over all repositories:
>   36 files changed, 930 insertions(+), 379 deletions(-)