From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 8A9B61FF0E0 for ; Thu, 06 Aug 2026 15:09:31 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 552CC2151C; Thu, 06 Aug 2026 15:09:31 +0200 (CEST) Date: Thu, 06 Aug 2026 15:09:22 +0200 From: Fabian =?iso-8859-1?q?Gr=FCnbichler?= Subject: Re: [PATCH proxmox v3 02/16] tls-certificates: add days_valid parameter to create_self_signed_cert To: pbs-devel@lists.proxmox.com, Shannon Sterz References: <20260805155308.519896-2-s.sterz@proxmox.com> <20260805155308.519896-4-s.sterz@proxmox.com> In-Reply-To: <20260805155308.519896-4-s.sterz@proxmox.com> MIME-Version: 1.0 User-Agent: astroid/0.17.0 (https://github.com/astroidmail/astroid) Message-Id: <1786021372.xnuxft8ug6.astroid@yuna.none> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1786021751005 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.119 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: ABCCCHFY462XZ2IPTFRR245DASYUYQDX X-Message-ID-Hash: ABCCCHFY462XZ2IPTFRR245DASYUYQDX X-MailFrom: f.gruenbichler@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On August 5, 2026 5:52 pm, Shannon Sterz wrote: > to allow specifying how long a certificate should be valid for. also > adds unit tests to verify this behavior. >=20 > Signed-off-by: Shannon Sterz > --- >=20 > Notes: > imo, we could go down even more. as far as i am aware there is no rea= l > limit that is being enforced here for self-signed certificates from a > browser perspective. they are already trusted on an exemption-basis > anyway. however, certificates signed by public CAs will only be valid > for a maximum of 47 days by 2029 [1]. > =20 > hence, i would personally either adopt the same limit or go down to a > year, as a sensible middle-ground. certificate rotation should really > be automated even in self-signed scenarios. we also had cases in the > past, where customers already ran into an issue because they wanted t= o > limit the lifetime of their certificates below 30 days [2]. meaning > that there is a need out there for shorter-lived certificates (though= , > in that case a custom CA & ACME setup was used). the main issue with decreasing the lifetime of the certificate is that for PBS in particular, it needs to be pinned in potentially a lot of places (that might not access the PBS system very often). so IMHO the order of application needs to be: - this series with a lifetime roughly matching a deployment of a PBS system - implement staging support on the PBS server-side, and all clients (PBS, PVE, PDM) - wait (for clients to upgrade, including some time for external clients to adapt as well - reduce lifetime to a year (and maybe warning threshold for getting rid of old, long-lived certificates) > =20 > [1]: https://github.com/cabforum/servercert/pull/553 > [2]: https://bugzilla.proxmox.com/show_bug.cgi?id=3D6372 >=20 > proxmox-tls-certificates/src/util.rs | 132 ++++++++++++++++++++++++++- > 1 file changed, 131 insertions(+), 1 deletion(-) >=20 > diff --git a/proxmox-tls-certificates/src/util.rs b/proxmox-tls-certifica= tes/src/util.rs > index 346872ac..98aa042e 100644 > --- a/proxmox-tls-certificates/src/util.rs > +++ b/proxmox-tls-certificates/src/util.rs > @@ -15,10 +15,13 @@ use crate::CertificateInfo; > /// subject alternative names will be set based on this value. > /// * `domain`: The optional domain which the node is in. If set, it wil= l be appended to `nodename` > /// to derive an FQDN as common and subject alternative name. > +/// * `days_valid`: The optional number of days that the certificate sho= uld be valid for. If not > +/// set, the certificate will be valid for 3650 days, almost ten years= . > pub fn create_self_signed_cert( > product_name: &str, > nodename: &str, > domain: Option<&str>, > + days_valid: Option, > ) -> Result<(PKey, X509), Error> { > let rsa =3D Rsa::generate(4096).unwrap(); > =20 > @@ -28,7 +31,7 @@ pub fn create_self_signed_cert( > =20 > let today =3D openssl::asn1::Asn1Time::days_from_now(0)?; > x509.set_not_before(&today)?; > - let expire =3D openssl::asn1::Asn1Time::days_from_now(365 * 10)?; > + let expire =3D openssl::asn1::Asn1Time::days_from_now(days_valid.unw= rap_or(365 * 10))?; > x509.set_not_after(&expire)?; > =20 > let mut fqdn =3D nodename.to_owned(); > @@ -207,3 +210,130 @@ fn asn1_time_to_unix(time: &openssl::asn1::Asn1Time= Ref) -> Result { > let mut c_tm =3D unsafe { c_tm.assume_init() }; > proxmox_time::timegm(&mut c_tm) > } > + > +#[cfg(test)] > +mod test { > + use super::*; > + > + fn get_self_signed_certificate_info( > + product_name: &str, > + nodename: &str, > + domain: Option<&str>, > + days_valid: Option, > + ) -> CertificateInfo { > + let cert =3D match create_self_signed_cert(product_name, nodenam= e, domain, days_valid) { > + Ok((_priv_key, certificate)) =3D> certificate, > + Err(e) =3D> panic!("could not create self signed certificate= - {e}"), > + }; > + > + let pem_bytes =3D match cert.to_pem() { > + Ok(pem) =3D> pem, > + Err(e) =3D> panic!("could not get pem bytes from signed cert= ificate - {e}"), > + }; > + > + match CertificateInfo::from_pem("", &pem_bytes) { > + Ok(cert_info) =3D> cert_info, > + Err(e) =3D> panic!("could not parse cert pem to cert info - = {e}"), > + } > + } > + > + #[test] > + fn self_signed_certificate_correct_with_product_and_name_only() { > + let cert_info =3D > + get_self_signed_certificate_info("Proxmox Test Product", "na= me", None, None); > + > + assert!(cert_info.subject.contains("O =3D Proxmox Test Product")= ); > + assert!(cert_info.subject.contains("CN =3D name")); > + assert_eq!( > + cert_info.san, > + vec![ > + "IP: [127, 0, 0, 1]", > + "IP: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]", > + "DNS: localhost", > + "DNS: name" > + ] > + ); > + } > + > + #[test] > + fn self_signed_certificate_correct_with_domain() { > + let cert_info =3D > + get_self_signed_certificate_info("Proxmox Test Product", "na= me", Some("fqdn"), None); > + > + assert!(cert_info.subject.contains("O =3D Proxmox Test Product")= ); > + assert!(cert_info.subject.contains("CN =3D name.fqdn")); > + assert_eq!( > + cert_info.san, > + vec![ > + "IP: [127, 0, 0, 1]", > + "IP: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]", > + "DNS: localhost", > + "DNS: name", > + "DNS: name.fqdn" > + ] > + ); > + } > + > + #[test] > + fn self_signed_certificate_correct_with_days_valid() { > + let in_two_days =3D proxmox_time::epoch_i64() + 2 * 24 * 60 * 60= ; > + let cert_info =3D > + get_self_signed_certificate_info("Proxmox Test Product", "na= me", None, Some(2)); > + > + assert!( > + cert_info > + .notafter > + .map(|a| a >=3D in_two_days) > + .unwrap_or_default() > + ); > + assert!( > + cert_info > + .notafter > + .map(|a| a < in_two_days + 24 * 60 * 60) > + .unwrap_or_default() > + ); > + assert!(cert_info.subject.contains("O =3D Proxmox Test Product")= ); > + assert!(cert_info.subject.contains("CN =3D name")); > + assert_eq!( > + cert_info.san, > + vec![ > + "IP: [127, 0, 0, 1]", > + "IP: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]", > + "DNS: localhost", > + "DNS: name", > + ] > + ); > + } > + > + #[test] > + fn self_signed_certificate_correct_with_domain_and_days_valid() { > + let in_two_days =3D proxmox_time::epoch_i64() + 2 * 24 * 60 * 60= ; > + let cert_info =3D > + get_self_signed_certificate_info("Proxmox Test Product", "na= me", Some("fqdn"), Some(2)); > + > + assert!( > + cert_info > + .notafter > + .map(|a| a >=3D in_two_days) > + .unwrap_or_default() > + ); > + assert!( > + cert_info > + .notafter > + .map(|a| a < in_two_days + 24 * 60 * 60) > + .unwrap_or_default() > + ); > + assert!(cert_info.subject.contains("O =3D Proxmox Test Product")= ); > + assert!(cert_info.subject.contains("CN =3D name.fqdn")); > + assert_eq!( > + cert_info.san, > + vec![ > + "IP: [127, 0, 0, 1]", > + "IP: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]", > + "DNS: localhost", > + "DNS: name", > + "DNS: name.fqdn" > + ] > + ); > + } > +} > --=20 > 2.47.3 >=20 >=20 >=20 >=20 >=20 >=20