From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 9166E1FF0E2 for ; Thu, 30 Jul 2026 15:44:40 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 57A0E214D7; Thu, 30 Jul 2026 15:44:40 +0200 (CEST) Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Thu, 30 Jul 2026 15:44:35 +0200 Message-Id: To: "Shannon Sterz" , Subject: Re: [PATCH datacenter-manager/proxmox{,-backup} 00/16] TLS Certificate Rotation X-Mailer: aerc 0.20.0 References: <20260730133158.418015-1-s.sterz@proxmox.com> In-Reply-To: <20260730133158.418015-1-s.sterz@proxmox.com> From: "Shannon Sterz" X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1785419066962 X-SPAM-LEVEL: Spam detection results: 1 AWL -1.356 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLACK 3 Contains an URL listed in the URIBL blacklist [types.rs] Message-ID-Hash: G4OUJBQCP4JV45KAELD7WJSSZPSOAFSH X-Message-ID-Hash: G4OUJBQCP4JV45KAELD7WJSSZPSOAFSH X-MailFrom: s.sterz@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Ah sorry, i just noticed that the v2 here is missing. sorry about that. On Thu Jul 30, 2026 at 3:31 PM CEST, Shannon Sterz wrote: > this series adds certificate rotation to Proxmox Backup Server and Proxmo= x > Datacenter Manager. currently, both products issue a certificate that is = valid > for almost 1000 years (365000 days). no cryptographic key can reasonably = be > considered secure for this amount of time. this series: > > - allows specifying the lifetime of the certificate when creating one via > proxmox-acme-api and reduces the default to 3650 days (almost ten years= ). > - sends and logs reminders 30 days before a certificate expires (pdm curr= ently > does not support the notification framework yet, so adding notification= s is > left as future work here). > - refreshes a certificate at the earliest 15 days before it expires, logs > and notifies when that happens. > - warns on certificates with excessive lifetimes (>3650 days) and documen= ts > how to manually update them. > - for pdm: exposes cert handling cli methods in proxmox-datacenter-manage= r-admin. > - fixes up some inconsistencies in the ui and docs in regards to pdm's > certificate location. > - adjusts the severity of acme renewal error notifications for pbs > > ## Testing > > the easiest way to test this is to manipulate the date of the host with `= date > --set` and then manually trigger the daily update binary for each product= : > > * PBS: `/usr/lib/x86_64-linux-gnu/proxmox-backup/proxmox-daily-update` > * PDM: `/usr/libexec/proxmox/proxmox-datacenter-manager-daily-update` > > you can then check the logs and the certificate itself to see what happen= ed. > specifying the `PBS_LOG` environment variable with the parameter `trace` = or > `debug` will also enable debug logging here. > > ## Open Questions > > + 10 years is still a long time and i'd rather reduce that further down i= f > possible. see the patch 02 for proxmox-tls-certificates for more info. > + should we remove pre-existing long lasting certificates by ourselves? i= mo > that is too risky at the moment given that an unplanned certificate rot= ation > could cause backups to fail. > + notifying every day for 15 days before the renewal might be excessive, = see > the second commit for pbs. > > ## Future Work > > - pve and pdm should be extended to allow automatically updating allowed > fingerprints before a new self-signed certificate goes into action. a s= eries > demonstrating this for pve<->pdm has already been sent [1]. if this ser= ies gets > approved, i'll happily adapt the mechanism for pbs<->pve and pbs<->pdm. > - pdm should send notifications similar to pbs once support for notificat= ions > is added. > > ## Changelog > > * v1: https://lore.proxmox.com/pbs-devel/20260422124022.17952-1-s.sterz@p= roxmox.com/ > > changes since v1 (thanks @ Lukas Wagner): > > + dropped a patch for proxmox-yew-comp that got applied already > + rebased on current master for all three repos > + created new `proxmox-tls-certificates` crate and moved several help= ers > there. reexposing functions in proxmox-acme-api to avoid breakage. > + added unit tests and more documentation to tls helpers > + adjusted the severity of error and renewal notifications > + adapted the upcoming renewal template for pbs to inform about the > earliest data a renewal could happen > > * rfc: https://lore.proxmox.com/pbs-devel/20260407135714.490747-1-s.sterz= @proxmox.com/ > > changes since rfc: > > + add patches that avoid hard-coding the certificate file name in yew= -comp > and use the proper filename in pdm > + update pdm renewal docs patch to avoid confusion > + re-base on current master > > [1]: https://lore.proxmox.com/pdm-devel/20260611120327.257523-1-s.sterz@p= roxmox.com/ > > > proxmox: > > Shannon Sterz (4): > acme-api/tls-certificates: add new crate collecting tls realted > helpers > tls-certificates: add days_valid parameter to create_self_signed_cert > tls-certificates: add self_signed_cert_expires_in to check > certificates > acme-api: stop re-exporting create_self_signed_cert > > Cargo.toml | 2 + > proxmox-acme-api/Cargo.toml | 2 + > proxmox-acme-api/src/certificate_helpers.rs | 195 ---------- > proxmox-acme-api/src/lib.rs | 2 +- > proxmox-acme-api/src/types.rs | 51 +-- > proxmox-tls-certificates/Cargo.toml | 41 ++ > proxmox-tls-certificates/src/lib.rs | 7 + > proxmox-tls-certificates/src/types.rs | 54 +++ > proxmox-tls-certificates/src/util.rs | 395 ++++++++++++++++++++ > 9 files changed, 503 insertions(+), 246 deletions(-) > create mode 100644 proxmox-tls-certificates/Cargo.toml > create mode 100644 proxmox-tls-certificates/src/lib.rs > create mode 100644 proxmox-tls-certificates/src/types.rs > create mode 100644 proxmox-tls-certificates/src/util.rs > > > backup: > > Shannon Sterz (6): > config: use proxmox_tls_certificates for generating self-signed > certificates > config/server/api: add certificate renewal logic including > notifications > daily update: warn about excessive self-signed certificate lifetime > docs: document force refreshing long-lived certificates > backup-manager cli: `cert update` can create auth and csrf key > notifications: use `Severity::Error` for acme renewal failures > > Cargo.toml | 3 + > debian/control | 2 + > debian/proxmox-backup-server.install | 6 ++ > docs/certificate-management.rst | 31 ++++++ > src/api2/node/certificates.rs | 9 +- > src/bin/proxmox-daily-update.rs | 43 ++++++++- > src/bin/proxmox_backup_manager/cert.rs | 2 + > src/config/mod.rs | 96 ++----------------- > src/server/notifications/mod.rs | 58 ++++++++++- > src/server/notifications/template_data.rs | 11 +++ > templates/Makefile | 68 +++++++------ > templates/default/cert-err-body.txt.hbs | 7 ++ > templates/default/cert-err-subject.txt.hbs | 1 + > templates/default/cert-refresh-body.txt.hbs | 8 ++ > .../default/cert-refresh-subject.txt.hbs | 1 + > .../cert-upcoming-refresh-body.txt.hbs | 10 ++ > .../cert-upcoming-refresh-subject.txt.hbs | 1 + > 17 files changed, 237 insertions(+), 120 deletions(-) > create mode 100644 templates/default/cert-err-body.txt.hbs > create mode 100644 templates/default/cert-err-subject.txt.hbs > create mode 100644 templates/default/cert-refresh-body.txt.hbs > create mode 100644 templates/default/cert-refresh-subject.txt.hbs > create mode 100644 templates/default/cert-upcoming-refresh-body.txt.hbs > create mode 100644 templates/default/cert-upcoming-refresh-subject.txt.h= bs > > > datacenter-manager: > > Shannon Sterz (6): > certs: use proxmox-tls-certificates directly, add days_valid paramter > api/auth/bin: add certificate renewal logic > cli: expose certificate management endpoints via the cli > daily-update: warn about certificates with excessive lifetimes > docs: add section on forcing a new self-signed certificate > docs/certificates: use correct certificate file name > > Cargo.toml | 2 + > cli/admin/Cargo.toml | 2 + > cli/admin/src/cert.rs | 86 +++++++++++++++++++ > cli/admin/src/main.rs | 2 + > debian/control | 2 + > docs/certificate-management.rst | 32 +++++++ > server/Cargo.toml | 1 + > server/src/api/nodes/certificates.rs | 19 ++-- > server/src/auth/certs.rs | 19 +++- > ...proxmox-datacenter-manager-daily-update.rs | 38 ++++++++ > 10 files changed, 190 insertions(+), 13 deletions(-) > create mode 100644 cli/admin/src/cert.rs > > > Summary over all repositories: > 36 files changed, 930 insertions(+), 379 deletions(-)