Re: [PATCH proxmox-backup v3 05/16] config: use proxmox_tls_certificates for generating self-signed certificates

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

On August 5, 2026 5:52 pm, Shannon Sterz wrote:
> to avoid duplicating almost identical code here, re-use the version
> from `proxmox_tls_certificates::create_self_signed_cert`. for
> `days_valid` specify `None` to opt into the default of 3650 days.

since you write that it is "almost duplicate", a small summary of where
they might differ would be great ;)

AFAICT the switch from 1000 years -> 10 years is the only semantic
change here?

tbh I am not sure whether the behaviour of appending the search domain
to the nodename (still) makes much sense, maybe the interface should
rather be an additional list of SANs, and the caller can decide how to
create them?

for some products, we might want to specify them in a config file. for
others, we might want to look them up via `hostname -f` and fallback to
the search domain thing we've been doing historically? for some we might
want to add IP addresses, for others we might not want that (and we
definitely don't want to have "query IP" logic in
proxmox-tls-certificates..)

IMHO similar logic applies to the subject. that probably means we want
some helpers to build a subject name (if we don't want to expose openssl
types here). but then again, the helper we move to here is openssl
specific anyway..

> 
> Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
> ---
>  Cargo.toml        |  3 ++
>  debian/control    |  2 +
>  src/config/mod.rs | 94 ++++-------------------------------------------
>  3 files changed, 13 insertions(+), 86 deletions(-)
> 
> diff --git a/Cargo.toml b/Cargo.toml
> index a2dcf85c3..df5f8942c 100644
> --- a/Cargo.toml
> +++ b/Cargo.toml
> @@ -97,6 +97,7 @@ proxmox-sys = "1"
>  proxmox-systemd = "1.0.1"
>  proxmox-tfa = { version = "6.0.3", features = [ "api", "api-types" ] }
>  proxmox-time = "2"
> +proxmox-tls-certificates = { version = "1", features = [ "impl" ] }
>  proxmox-upgrade-checks = "1"
>  proxmox-uuid = { version = "1", features = [ "serde" ] }
>  proxmox-worker-task = "1"
> @@ -255,6 +256,7 @@ proxmox-sys = { workspace = true, features = [ "timer" ] }
>  proxmox-systemd.workspace = true
>  proxmox-tfa.workspace = true
>  proxmox-time.workspace = true
> +proxmox-tls-certificates.workspace = true
>  proxmox-upgrade-checks.workspace = true
>  proxmox-uuid.workspace = true
>  proxmox-worker-task.workspace = true
> @@ -325,6 +327,7 @@ proxmox-rrd-api-types.workspace = true
>  #proxmox-systemd = { path = "../proxmox/proxmox-systemd" }
>  #proxmox-tfa = { path = "../proxmox/proxmox-tfa" }
>  #proxmox-time = { path = "../proxmox/proxmox-time" }
> +#proxmox-tls-certificates = { path = "../proxmox/proxmox-tls-certificates" }
>  #proxmox-upgrade-checks = { path = "../proxmox/proxmox-upgrade-checks" }
>  #proxmox-uuid = { path = "../proxmox/proxmox-uuid" }
>  #proxmox-worker-task = { path = "../proxmox/proxmox-worker-task" }
> diff --git a/debian/control b/debian/control
> index d8dcabdb7..8b9607fff 100644
> --- a/debian/control
> +++ b/debian/control
> @@ -132,6 +132,8 @@ Build-Depends: debhelper (>= 12~),
>                 librust-proxmox-tfa-6+api-types-dev (>= 6.0.3-~~),
>                 librust-proxmox-tfa-6+default-dev (>= 6.0.3-~~),
>                 librust-proxmox-time-2+default-dev,
> +               librust-proxmox-tls-certificates-1+default-dev,
> +               librust-proxmox-tls-certificates-1+impl-dev,
>                 librust-proxmox-upgrade-checks-1+default-dev,
>                 librust-proxmox-uuid-1+default-dev,
>                 librust-proxmox-uuid-1+serde-dev,
> diff --git a/src/config/mod.rs b/src/config/mod.rs
> index 98683186e..bbca5a9af 100644
> --- a/src/config/mod.rs
> +++ b/src/config/mod.rs
> @@ -5,9 +5,6 @@
>  
>  use anyhow::{Error, bail, format_err};
>  use nix::sys::stat::Mode;
> -use openssl::pkey::PKey;
> -use openssl::rsa::Rsa;
> -use openssl::x509::X509Builder;
>  use std::path::Path;
>  
>  use proxmox_lang::try_block;
> @@ -90,92 +87,17 @@ pub fn update_self_signed_cert(force: bool) -> Result<(), Error> {
>      if key_path.exists() && cert_path.exists() && !force {
>          return Ok(());
>      }
> -
> -    let rsa = Rsa::generate(4096).unwrap();
> -
> -    let priv_pem = rsa.private_key_to_pem()?;
> -
> -    let mut x509 = X509Builder::new()?;
> -
> -    x509.set_version(2)?;
> -
> -    let today = openssl::asn1::Asn1Time::days_from_now(0)?;
> -    x509.set_not_before(&today)?;
> -    let expire = openssl::asn1::Asn1Time::days_from_now(365 * 1000)?;
> -    x509.set_not_after(&expire)?;
> -
> -    let nodename = proxmox_sys::nodename();
> -    let mut fqdn = nodename.to_owned();
> -
>      let resolv_conf = crate::api2::node::dns::read_etc_resolv_conf()?;
> -    if let Some(search) = resolv_conf["search"].as_str() {
> -        fqdn.push('.');
> -        fqdn.push_str(search);
> -    }
>  
> -    // we try to generate an unique 'subject' to avoid browser problems
> -    //(reused serial numbers, ..)
> -    let uuid = proxmox_uuid::Uuid::generate();
> +    let (priv_key, cert) = proxmox_tls_certificates::create_self_signed_cert(
> +        "Proxmox Backup Server",
> +        proxmox_sys::nodename(),
> +        resolv_conf["search"].as_str(),
> +        None,
> +    )?;
>  
> -    let mut subject_name = openssl::x509::X509NameBuilder::new()?;
> -    subject_name.append_entry_by_text("O", "Proxmox Backup Server")?;
> -    subject_name.append_entry_by_text("OU", &format!("{uuid:X}"))?;
> -    subject_name.append_entry_by_text("CN", &fqdn)?;
> -    let subject_name = subject_name.build();
> -
> -    x509.set_subject_name(&subject_name)?;
> -    x509.set_issuer_name(&subject_name)?;
> -
> -    let bc = openssl::x509::extension::BasicConstraints::new(); // CA = false
> -    let bc = bc.build()?;
> -    x509.append_extension(bc)?;
> -
> -    let usage = openssl::x509::extension::ExtendedKeyUsage::new()
> -        .server_auth()
> -        .build()?;
> -    x509.append_extension(usage)?;
> -
> -    let context = x509.x509v3_context(None, None);
> -
> -    let mut alt_names = openssl::x509::extension::SubjectAlternativeName::new();
> -
> -    alt_names.ip("127.0.0.1");
> -    alt_names.ip("::1");
> -
> -    alt_names.dns("localhost");
> -
> -    if nodename != "localhost" {
> -        alt_names.dns(nodename);
> -    }
> -    if nodename != fqdn {
> -        alt_names.dns(&fqdn);
> -    }
> -
> -    let alt_names = alt_names.build(&context)?;
> -
> -    x509.append_extension(alt_names)?;
> -
> -    let pub_pem = rsa.public_key_to_pem()?;
> -    let pubkey = PKey::public_key_from_pem(&pub_pem)?;
> -
> -    x509.set_pubkey(&pubkey)?;
> -
> -    let context = x509.x509v3_context(None, None);
> -    let ext = openssl::x509::extension::SubjectKeyIdentifier::new().build(&context)?;
> -    x509.append_extension(ext)?;
> -
> -    let context = x509.x509v3_context(None, None);
> -    let ext = openssl::x509::extension::AuthorityKeyIdentifier::new()
> -        .keyid(true)
> -        .build(&context)?;
> -    x509.append_extension(ext)?;
> -
> -    let privkey = PKey::from_rsa(rsa)?;
> -
> -    x509.sign(&privkey, openssl::hash::MessageDigest::sha256())?;
> -
> -    let x509 = x509.build();
> -    let cert_pem = x509.to_pem()?;
> +    let cert_pem = cert.to_pem()?;
> +    let priv_pem = priv_key.private_key_to_pem_pkcs8()?;
>  
>      set_proxy_certificate(&cert_pem, &priv_pem)?;
>  
> -- 
> 2.47.3
> 
> 
> 
> 
> 
>