Re: [PATCH proxmox v3 02/16] tls-certificates: add days_valid parameter to create_self_signed_cert

["Shannon Sterz" <s.sterz@proxmox.com>]

On Thu Aug 6, 2026 at 3:09 PM CEST, Fabian Grünbichler wrote:
> On August 5, 2026 5:52 pm, Shannon Sterz wrote:
>> to allow specifying how long a certificate should be valid for. also
>> adds unit tests to verify this behavior.
>>
>> Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
>> ---
>>
>> Notes:
>>     imo, we could go down even more. as far as i am aware there is no real
>>     limit that is being enforced here for self-signed certificates from a
>>     browser perspective. they are already trusted on an exemption-basis
>>     anyway. however, certificates signed by public CAs will only be valid
>>     for a maximum of 47 days by 2029 [1].
>>
>>     hence, i would personally either adopt the same limit or go down to a
>>     year, as a sensible middle-ground. certificate rotation should really
>>     be automated even in self-signed scenarios. we also had cases in the
>>     past, where customers already ran into an issue because they wanted to
>>     limit the lifetime of their certificates below 30 days [2]. meaning
>>     that there is a need out there for shorter-lived certificates (though,
>>     in that case a custom CA & ACME setup was used).
>
> the main issue with decreasing the lifetime of the certificate is that
> for PBS in particular, it needs to be pinned in potentially a lot of
> places (that might not access the PBS system very often).
>
> so IMHO the order of application needs to be:
> - this series with a lifetime roughly matching a deployment of a PBS
>   system
> - implement staging support on the PBS server-side, and all clients
>   (PBS, PVE, PDM)
> - wait (for clients to upgrade, including some time for external clients
>   to adapt as well
> - reduce lifetime to a year (and maybe warning threshold for getting rid
>   of old, long-lived certificates)

completely agree. imo 10 years is a reasonable time frame for this. that
would 5 pbs releases or so. imo we can do the first three steps outlined
here before pbs 5 drops and the decrease the lifetime with pbs 6 or 7.
that should give enough time for everyone to adjust hopefully.

if really required, users could still get a custom long-lived cert and
use that instead.

-->8 snip 8<--