Re: [PATCH common/proxmox-acme v4 0/3] fix #5978: pem parser: relax parsing of chain entries

["Thomas Ellmenreich" <t.ellmenreich@proxmox.com>]

gentle ping...

also recived a ping on the Bugzilla: [0]

[0]: https://bugzilla.proxmox.com/show_bug.cgi?id=5978

On Wed Aug 5, 2026 at 4:11 PM CEST, Thomas Ellmenreich wrote:
> According to RFC 8555, expected certchains should come
> without whitespace or explanatory texts inbetween chain
> entries. These two patches relax our parser to also
> accept text or whitespaces inbetween chain entries.
>
> To make sure that the acme changes work as expected I
> setup the pebble acme server [1] locally, and worked
> through the acme flow to get a new certificate. I then
> manually modified the final certificate to contain
> descriptive text which worked without issues.
>
> changes since v3:
> - check_pem was reworked to not be recursive
>
> - the check_pem tests now also check the erroring version to
>   make sure that an exception is thrown
>
> - moved the tests to their own commit
>
> - wrapped the error message produced by check_pem when
>   called in proxmox-acme with chomp to avoid double newlines
>
> - corrected the capitalization of different acronyms
>
> changes since v2:
> - cleaner implementation and correction of mistakes in
>   check_pem in pve-common
>
> - get_certificate in proxmox-acme now correctly calls
>   check_pem with the 'multiple' option enabled
>
> - removed ambiguity in the error messages of
>   get_certificate
>
> - correction of tests, to better compare returned value
>   to expected value
>
> - performed proper end-to-end test with pebble [1]
>
> - proper formatting (hopefully)
>
> changes since v1:
> - Where in v1 check_pem was just a wrapper of split_pem,
>   they now perform different functions
>
> - split_pem now purely splits the PEM chain into separate
>   entries and does no further validation. Returning each
>   entry with its leading text.
>
> - check_pem retains the original functionality, except
>   when the multiple option is active, in which case it
>   uses split_pem to get single entries and then calls
>   itself recursively
>
> - On the ACME side, errors are now captured, wrapped,
>   and then rethrown.
>
> [1] https://github.com/letsencrypt/pebble
>
>
> pve-common:
>
> Thomas Ellmenreich (2):
>   fix #5978: pem parser: relax parsing of chain entries
>   pem parser: add testsuite for check_ and split_pem
>
>  src/PVE/Certificate.pm |  39 ++++-
>  test/Makefile          |   2 +
>  test/check_pem_test.pl | 365 +++++++++++++++++++++++++++++++++++++++++
>  test/split_pem_test.pl | 279 +++++++++++++++++++++++++++++++
>  4 files changed, 677 insertions(+), 8 deletions(-)
>  create mode 100755 test/check_pem_test.pl
>  create mode 100755 test/split_pem_test.pl
>
>
> proxmox-acme:
>
> Thomas Ellmenreich (1):
>   fix #5978: pem parser: relax parsing of chain entries:
>
>  src/PVE/ACME.pm | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
>
>
> Summary over all repositories:
>   5 files changed, 684 insertions(+), 13 deletions(-)