Re: [PATCH proxmox{,-backup,-datacenter-manager} 0/7] acme: fix #6372 implement basic ARI support

[Manuel Federanko <m.federanko@proxmox.com>]

Thanks for testing.

On 2026-07-27 6:15 PM, Shan Shaji wrote:
> Hi,
> 
> I applied the patches and performed some testing with Proxmox Backup Server.
> 
> * In the UI, the force option is always set to true, so the lead-time check is
>   skipped and a new certificate is ordered every time.
> * I ordered a certificate through the UI, which generated a certificate valid from:
> 
>   2026-07-27 16:40:42 to 2026-10-25 15:40:41
> 
> * Then, tried to order the certificate using proxmox-backup-manager with
>   the --force option set to false. The certificate was not renewed, and
>   the renewal time from the suggested window was shown in the task log.
>   However, it was not displayed in the console, as I mentioned in an
>   earlier reply.
> 
Since the ARI workflow is a bit more involved I moved these checks into
the worker process. I'm not sure how best to go about passing messages back
at the CLI, but would also prefer this. Suggestions are welcome :)
>   Certificate is scheduled for renewal in 1M 4w 2d 8h 33m 13s by ARI
> 
> * Now deleted the custom certificate. Since PBS was now using the self-signed
>   certificate, the initial ordering request failed because it included a
>   certificate ID that the server could not parse. It then retried without the
>   ARI certificate ID, and the request succeeded. Observed the same behavior
>   when ordering through the CLI using proxmox-backup-manager, as long as
>   the --force option was set to true.
> 
>   However, when --force is set to false, parsing the ARI certificate ID fails
>   and the certificate is not created.
> 
>   TASK ERROR: urn:ietf:params:acme:error:malformed: Parsing ARI CertID failed: urn:ietf:params:acme:error:malformed :: Invalid path
>   
>   Shouldn't we also need to retry without the certificate ID in this case?
>   I may have missed something, so please correct me if I am wrong.
IMO we could either improve the error here or retry when ari parsing fails, I'll
look into it.

> Will do further testing tomorrow.
> 
> On Thu Jun 25, 2026 at 4:13 PM CEST, Manuel Federanko wrote:
>>
>> This series implements basic ACME ARI [0] support for Proxmox Backup
>> Server and Proxmox Datacenter Manager. Currently both projects renew
>> once a fixed time has passed:
>>
> [snip]