Re: [PATCH proxmox-acme v3 2/2] fix #5978: pem parser: relax parsing of chain entries:

["Elias Huhsovitz" <e.huhsovitz@proxmox.com>]

On Fri Jul 3, 2026 at 12:51 PM CEST, Thomas Ellmenreich wrote:
> Instead of using a custom regex to parse pem chains, now uses
> the pve-common Certificate::check_pem function to do so. This
> now allows for additional text and whitespace inbetween the
> chain entries.
>
> Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
> ---

Good change to use standard pve-common implementation instead of custom
regex!

See comments below.

>  src/PVE/ACME.pm | 11 ++++++-----
>  1 file changed, 6 insertions(+), 5 deletions(-)
>
> diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
> index e6fb9c2..7adda25 100644
> --- a/src/PVE/ACME.pm
> +++ b/src/PVE/ACME.pm
> @@ -526,14 +526,15 @@ sub get_certificate {
>                      }
>                  }
>              }
> -            die "no matching alternate chain for '$root' returned by server\n"
> +            die "no matching alternate chain for '$root' provided by the acme server\n"
>                  if !defined($res);
>          }
>  
> -        if ($res =~ /^(-----BEGIN CERTIFICATE-----)(.+)(-----END CERTIFICATE-----)$/s) { # untaint
> -            return $1 . $2 . $3;
> -        }
> -        die "Server reply does not look like a PEM encoded certificate\n";
> +        my $parsed = eval { PVE::Certificate::check_pem($res, multiple => 1) };
> +        die
> +            "value returned by acme certificate url does not look like a PEM encoded certificate: $@\n"
> +            if $@;

nit: Error message inside of $@ might contain trailing newline. Consider
remvoing the newline before die statement. e.g.,

die "value returned by ACME certificate url does not look like a PEM encoded certificate: " . chomp($@) . "\n"
    if $@;

nit: in the error message "PEM" is capitalized by "acme" is not. Capitalize both for
consistency. e.g., code sample above.


> +        return $parsed;
>      };
>      $self->fatal("POST of '$order->{certificate}' failed - $@", $r) if $@;
>      return $return;