Re: [PATCH pve-cluster v3 2/3] Convert SSL cert generation config to CLI arguments

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

On Tue, Mar 17, 2026 at 05:00:20PM +0100, Thomas Lamprecht wrote:
> Am 17.03.26 um 15:22 schrieb Arthur Bied-Charreton:
> > Replace temporary OpenSSL config file with direct CLI arguments in PVE
> > node SSL cert generation.
> > 
> > Changes:
> > - Use '-subj' flag for distinguished name
> > - Use '-addext' flag for cert extensions
> > - Use '-copy_extensions copyall' to copy extensions from CSR to cert
> > - Remove temp config file and cleanup code
> 
> IMO an odd way to write a commit message, especially as I can see most of
> that from checking the, well, actual changes below... And only some parts
> got picked out.
> 
Good point, will rewrite this.
> Also, the 2048 bit is just silently dropped, is that implied somewhere?
> Such things should be actually mentioned. Please recheck all settings
> yourself to ensure this is a complete change.
> 
Yes, 2048 is the default (/etc/ssl/openssl.cnf). I should have made that 
clear in the commit message. Will add it in v4.
> > As suggested here:
> > https://lore.proxmox.com/pve-devel/20260123195300.0ae7fcc9@rosa.proxmox.com/T/#t
> 
> would be good to include some actual rationale, not just the link, as
> unlike the changes described above I cannot just get that from the diff
> or rest of the commit's info.
> 
Thanks for the feedback!
> 
> 
> > 
> > Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
> > ---
> >  src/PVE/Cluster/Setup.pm | 41 +++++++++-------------------------------
> >  1 file changed, 9 insertions(+), 32 deletions(-)
> > 
> > diff --git a/src/PVE/Cluster/Setup.pm b/src/PVE/Cluster/Setup.pm
> > index 4f528ba..b9cacfd 100644
> > --- a/src/PVE/Cluster/Setup.pm
> > +++ b/src/PVE/Cluster/Setup.pm
> > @@ -504,33 +504,6 @@ sub gen_pve_ssl_cert {
> >          $names .= ",DNS:$fqdn";
> >      }
> >  
> > -    my $sslconf = <<__EOD;
> > -RANDFILE = /root/.rnd
> > -extensions = v3_req
> > -
> > -[ req ]
> > -default_bits = 2048
> > -distinguished_name = req_distinguished_name
> > -req_extensions = v3_req
> > -prompt = no
> > -string_mask = nombstr
> > -
> > -[ req_distinguished_name ]
> > -organizationalUnitName = PVE Cluster Node
> > -organizationName = Proxmox Virtual Environment
> > -commonName = $fqdn
> > -
> > -[ v3_req ]
> > -basicConstraints = CA:FALSE
> > -extendedKeyUsage = serverAuth
> > -subjectAltName = $names
> > -__EOD
> > -
> > -    my $cfgfn = "/tmp/pvesslconf-$$.tmp";
> > -    my $fh = IO::File->new($cfgfn, "w");
> > -    print $fh $sslconf;
> > -    close($fh);
> > -
> >      my $reqfn = "/tmp/pvecertreq-$$.tmp";
> >      unlink $reqfn;
> >  
> > @@ -541,18 +514,23 @@ __EOD
> >              'req',
> >              '-batch',
> >              '-new',
> > -            '-config',
> > -            $cfgfn,
> >              '-key',
> >              $pvessl_key_fn,
> >              '-out',
> >              $reqfn,
> > +            '-subj',
> > +            "/OU=PVE Cluster Node/O=Proxmox Virtual Environment/CN=$fqdn",
> > +            '-addext',
> > +            'basicConstraints=CA:FALSE',
> > +            '-addext',
> > +            'extendedKeyUsage=serverAuth',
> > +            '-addext',
> > +            "subjectAltName=$names",
> >          ]);
> >      };
> >  
> >      if (my $err = $@) {
> >          unlink $reqfn;
> > -        unlink $cfgfn;
> >          die "unable to generate pve certificate request:\n$err";
> >      }
> >  
> > @@ -581,13 +559,12 @@ __EOD
> >              'openssl', 'x509', '-req', '-in', $reqfn, '-days', $daysleft, '-out',
> >              $pvessl_cert_fn,
> >              '-CAkey', $pveca_key_fn, '-CA', $pveca_cert_fn, '-CAserial', $pveca_srl_fn,
> > -            '-extfile', $cfgfn,
> > +            '-copy_extensions', 'copyall',
> >          ]);
> >      };
> >      my $err = $@;
> >  
> >      unlink $reqfn or $!{ENOENT} or warn "failed to clean up '$reqfn' - $!";
> > -    unlink $cfgfn or $!{ENOENT} or warn "failed to clean up '$cfgfn' - $!";
> >  
> >      die "unable to generate pve ssl certificate:\n$err" if $err;
> >  }
>