From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 989DC1FF0AB for ; Wed, 23 Sep 2026 14:18:44 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id C9ABA21533; Wed, 23 Sep 2026 14:18:41 +0200 (CEST) Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Wed, 23 Sep 2026 14:18:35 +0200 Message-Id: Subject: Re: [PATCH common/proxmox-acme v4 0/3] fix #5978: pem parser: relax parsing of chain entries From: "Thomas Ellmenreich" To: "Thomas Ellmenreich" , X-Mailer: aerc 0.20.0 References: <20260805141114.190477-1-t.ellmenreich@proxmox.com> In-Reply-To: <20260805141114.190477-1-t.ellmenreich@proxmox.com> X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1790165915093 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.517 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: CNVQ36DNI3F4LLH4BZC3R7LJDHINUMTU X-Message-ID-Hash: CNVQ36DNI3F4LLH4BZC3R7LJDHINUMTU X-MailFrom: t.ellmenreich@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: gentle ping... also recived a ping on the Bugzilla: [0] [0]: https://bugzilla.proxmox.com/show_bug.cgi?id=3D5978 On Wed Aug 5, 2026 at 4:11 PM CEST, Thomas Ellmenreich wrote: > According to RFC 8555, expected certchains should come > without whitespace or explanatory texts inbetween chain > entries. These two patches relax our parser to also > accept text or whitespaces inbetween chain entries. > > To make sure that the acme changes work as expected I > setup the pebble acme server [1] locally, and worked > through the acme flow to get a new certificate. I then > manually modified the final certificate to contain > descriptive text which worked without issues. > > changes since v3: > - check_pem was reworked to not be recursive > > - the check_pem tests now also check the erroring version to > make sure that an exception is thrown > > - moved the tests to their own commit > > - wrapped the error message produced by check_pem when > called in proxmox-acme with chomp to avoid double newlines > > - corrected the capitalization of different acronyms > > changes since v2: > - cleaner implementation and correction of mistakes in > check_pem in pve-common > > - get_certificate in proxmox-acme now correctly calls > check_pem with the 'multiple' option enabled > > - removed ambiguity in the error messages of > get_certificate > > - correction of tests, to better compare returned value > to expected value > > - performed proper end-to-end test with pebble [1] > > - proper formatting (hopefully) > > changes since v1: > - Where in v1 check_pem was just a wrapper of split_pem, > they now perform different functions > > - split_pem now purely splits the PEM chain into separate > entries and does no further validation. Returning each > entry with its leading text. > > - check_pem retains the original functionality, except > when the multiple option is active, in which case it > uses split_pem to get single entries and then calls > itself recursively > > - On the ACME side, errors are now captured, wrapped, > and then rethrown. > > [1] https://github.com/letsencrypt/pebble > > > pve-common: > > Thomas Ellmenreich (2): > fix #5978: pem parser: relax parsing of chain entries > pem parser: add testsuite for check_ and split_pem > > src/PVE/Certificate.pm | 39 ++++- > test/Makefile | 2 + > test/check_pem_test.pl | 365 +++++++++++++++++++++++++++++++++++++++++ > test/split_pem_test.pl | 279 +++++++++++++++++++++++++++++++ > 4 files changed, 677 insertions(+), 8 deletions(-) > create mode 100755 test/check_pem_test.pl > create mode 100755 test/split_pem_test.pl > > > proxmox-acme: > > Thomas Ellmenreich (1): > fix #5978: pem parser: relax parsing of chain entries: > > src/PVE/ACME.pm | 12 +++++++----- > 1 file changed, 7 insertions(+), 5 deletions(-) > > > Summary over all repositories: > 5 files changed, 684 insertions(+), 13 deletions(-)