Re: [PATCH proxmox v3 03/16] tls-certificates: add self_signed_cert_expires_in to check certificates

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

On August 5, 2026 5:52 pm, Shannon Sterz wrote:
> this is useful when self-signed certificates are in use. it
> heuristically checks whether a certificate is self-signed by the
> specified node and returns for how many more days the certificate is
> valid if it is a self-signed certificate.
> 
> Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
> ---
>  proxmox-tls-certificates/Cargo.toml  |  2 +
>  proxmox-tls-certificates/src/lib.rs  |  2 +-
>  proxmox-tls-certificates/src/util.rs | 55 ++++++++++++++++++++++++++++
>  3 files changed, 58 insertions(+), 1 deletion(-)
> 
> diff --git a/proxmox-tls-certificates/Cargo.toml b/proxmox-tls-certificates/Cargo.toml
> index 3a7b97cd..658a700d 100644
> --- a/proxmox-tls-certificates/Cargo.toml
> +++ b/proxmox-tls-certificates/Cargo.toml
> @@ -16,6 +16,7 @@ hex = { workspace = true, optional = true }
>  libc = { workspace = true, optional = true }
>  openssl = { workspace = true, optional = true }
>  serde = { workspace = true, features = [ "derive" ] }
> +regex = { workspace = true, optional = true }
>  
>  proxmox-schema = { workspace = true, features = [ "api-macro" ] }
>  proxmox-time = { workspace = true, optional = true }
> @@ -29,6 +30,7 @@ impl = [
>      "dep:hex",
>      "dep:libc",
>      "dep:openssl",
> +    "dep:regex",
>  
>      "dep:proxmox-time",
>      "dep:proxmox-uuid",
> diff --git a/proxmox-tls-certificates/src/lib.rs b/proxmox-tls-certificates/src/lib.rs
> index 454c700f..66def7d6 100644
> --- a/proxmox-tls-certificates/src/lib.rs
> +++ b/proxmox-tls-certificates/src/lib.rs
> @@ -4,4 +4,4 @@ pub use types::CertificateInfo;
>  #[cfg(feature = "impl")]
>  mod util;
>  #[cfg(feature = "impl")]
> -pub use util::create_self_signed_cert;
> +pub use util::{create_self_signed_cert, self_signed_cert_expires_in};
> diff --git a/proxmox-tls-certificates/src/util.rs b/proxmox-tls-certificates/src/util.rs
> index 98aa042e..a07903d8 100644
> --- a/proxmox-tls-certificates/src/util.rs
> +++ b/proxmox-tls-certificates/src/util.rs
> @@ -2,12 +2,54 @@ use std::mem::MaybeUninit;
>  
>  use anyhow::{Error, bail, format_err};
>  use foreign_types::ForeignTypeRef;
> +use openssl::asn1::Asn1Time;
>  use openssl::pkey::{PKey, Private};
>  use openssl::rsa::Rsa;
>  use openssl::x509::{X509, X509Builder};
>  
>  use crate::CertificateInfo;
>  
> +proxmox_schema::const_regex! {
> +    SELF_SIGNED_REGEX =
> +        // O = $product_name, OU = $uuid, CN = $nodename
> +        r#"^O\s?=\s(?P<product>.*)?, OU\s?=\s?[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}, CN\s?=\s?(?P<fqdn>.*)$"#;
> +}
> +
> +/// Check whether the current certificate is self-signed and returns the remaining days the
> +/// certificate is valid for.

I am a bit confused by this description - do we want to check that it is
self-signed? then we should check that cert.subject == cert.issuer (or
better, actual_cert.issued(&actual_cert) via `openssl` ;))

or do we want to check that it seems to be created by our product stack?
then we should maybe name this a bit differently and document what the
semantics/expectations are?

or should we maybe make this two helpers, one checking expiry, one
checking self-signed/..-ness (and if needed for a smooth migration, keep
a deprecated combined helper around for a bit)?

since the next patch drops the compat-re-export of this helper, it seems
to me we could rework the interface and then drop the old one entirely?

> +pub fn self_signed_cert_expires_in(
> +    product_name: &str,
> +    nodename: &str,
> +    domain: Option<&str>,
> +    cert: CertificateInfo,
> +) -> Result<Option<i32>, Error> {
> +    let Some(captures) = (SELF_SIGNED_REGEX.regex_obj)().captures(&cert.issuer) else {
> +        return Ok(None);
> +    };
> +
> +    let mut fqdn = nodename.to_string();
> +
> +    if let Some(domain) = domain {
> +        fqdn = format!("{fqdn}.{domain}");
> +    }
> +
> +    if captures["product"] != *product_name {
> +        return Ok(None);
> +    }
> +
> +    if captures["fqdn"] != fqdn {
> +        return Ok(None);
> +    }
> +
> +    let now = Asn1Time::from_unix(proxmox_time::epoch_i64())?;
> +    let not_after = Asn1Time::from_unix(cert.notafter.ok_or_else(|| {
> +        format_err!("Could not get \"not after\" epoch for current certificate.")
> +    })?)?;
> +
> +    let diff = now.diff(&not_after)?;
> +    Ok(Some(diff.days))
> +}
> +
>  /// Create a new self-signed certificate and its private key.
>  ///
>  /// * `product_name`: The name of the product, will be used as the organization of the certificate.
> @@ -237,6 +279,19 @@ mod test {
>          }
>      }
>  
> +    #[test]
> +    fn self_signed_cert_expires_in_gets_correct_days() {
> +        let cert_info =
> +            get_self_signed_certificate_info("Proxmox Test Product", "name", Some("fqdn"), Some(2));
> +
> +        match self_signed_cert_expires_in("Proxmox Test Product", "name", Some("fqdn"), cert_info) {
> +            // allow the range [1,2] due to truncation, the test could take too long to always yield "2" here
> +            Ok(Some(days)) => assert!((1..=2).contains(&days)),
> +            Ok(None) => panic!("not a self-signed certificate"),
> +            Err(e) => panic!("error occurred checking certificate - {e:#}"),
> +        }
> +    }
> +
>      #[test]
>      fn self_signed_certificate_correct_with_product_and_name_only() {
>          let cert_info =
> -- 
> 2.47.3
> 
> 
> 
> 
> 
>