Re: [PATCH proxmox v3 03/16] tls-certificates: add self_signed_cert_expires_in to check certificates

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

On August 6, 2026 3:09 pm, Fabian Grünbichler wrote:
> On August 5, 2026 5:52 pm, Shannon Sterz wrote:
>> this is useful when self-signed certificates are in use. it
>> heuristically checks whether a certificate is self-signed by the
>> specified node and returns for how many more days the certificate is
>> valid if it is a self-signed certificate.
>> 
>> Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
>> ---
>>  proxmox-tls-certificates/Cargo.toml  |  2 +
>>  proxmox-tls-certificates/src/lib.rs  |  2 +-
>>  proxmox-tls-certificates/src/util.rs | 55 ++++++++++++++++++++++++++++
>>  3 files changed, 58 insertions(+), 1 deletion(-)
>> 
>> diff --git a/proxmox-tls-certificates/Cargo.toml b/proxmox-tls-certificates/Cargo.toml
>> index 3a7b97cd..658a700d 100644
>> --- a/proxmox-tls-certificates/Cargo.toml
>> +++ b/proxmox-tls-certificates/Cargo.toml
>> @@ -16,6 +16,7 @@ hex = { workspace = true, optional = true }
>>  libc = { workspace = true, optional = true }
>>  openssl = { workspace = true, optional = true }
>>  serde = { workspace = true, features = [ "derive" ] }
>> +regex = { workspace = true, optional = true }
>>  
>>  proxmox-schema = { workspace = true, features = [ "api-macro" ] }
>>  proxmox-time = { workspace = true, optional = true }
>> @@ -29,6 +30,7 @@ impl = [
>>      "dep:hex",
>>      "dep:libc",
>>      "dep:openssl",
>> +    "dep:regex",
>>  
>>      "dep:proxmox-time",
>>      "dep:proxmox-uuid",
>> diff --git a/proxmox-tls-certificates/src/lib.rs b/proxmox-tls-certificates/src/lib.rs
>> index 454c700f..66def7d6 100644
>> --- a/proxmox-tls-certificates/src/lib.rs
>> +++ b/proxmox-tls-certificates/src/lib.rs
>> @@ -4,4 +4,4 @@ pub use types::CertificateInfo;
>>  #[cfg(feature = "impl")]
>>  mod util;
>>  #[cfg(feature = "impl")]
>> -pub use util::create_self_signed_cert;
>> +pub use util::{create_self_signed_cert, self_signed_cert_expires_in};
>> diff --git a/proxmox-tls-certificates/src/util.rs b/proxmox-tls-certificates/src/util.rs
>> index 98aa042e..a07903d8 100644
>> --- a/proxmox-tls-certificates/src/util.rs
>> +++ b/proxmox-tls-certificates/src/util.rs
>> @@ -2,12 +2,54 @@ use std::mem::MaybeUninit;
>>  
>>  use anyhow::{Error, bail, format_err};
>>  use foreign_types::ForeignTypeRef;
>> +use openssl::asn1::Asn1Time;
>>  use openssl::pkey::{PKey, Private};
>>  use openssl::rsa::Rsa;
>>  use openssl::x509::{X509, X509Builder};
>>  
>>  use crate::CertificateInfo;
>>  
>> +proxmox_schema::const_regex! {
>> +    SELF_SIGNED_REGEX =
>> +        // O = $product_name, OU = $uuid, CN = $nodename
>> +        r#"^O\s?=\s(?P<product>.*)?, OU\s?=\s?[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}, CN\s?=\s?(?P<fqdn>.*)$"#;
>> +}
>> +
>> +/// Check whether the current certificate is self-signed and returns the remaining days the
>> +/// certificate is valid for.
> 
> I am a bit confused by this description - do we want to check that it is
> self-signed? then we should check that cert.subject == cert.issuer (or
> better, actual_cert.issued(&actual_cert) via `openssl` ;))
> 
> or do we want to check that it seems to be created by our product stack?
> then we should maybe name this a bit differently and document what the
> semantics/expectations are?
> 
> or should we maybe make this two helpers, one checking expiry, one
> checking self-signed/..-ness (and if needed for a smooth migration, keep
> a deprecated combined helper around for a bit)?
> 
> since the next patch drops the compat-re-export of this helper, it seems
> to me we could rework the interface and then drop the old one entirely?

summary of a short off-list discussion:
- we could consider adding a custom, non-critical extension to generated
  certificates, and use that to detect whether it is "one of ours"
- the current, 1000 year self-signed certs won't ever run into the
  refresh logic anyway, and any newly (re)generated ones would have the
  extension as marker
- PVE can use the "signed by cluster CA" property (once/if it switches
  over to a perlmod-ified variant of this series)