applied: [PATCH datacenter-manager v3 13/16] cli: expose certificate management endpoints via the cli

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

On August 5, 2026 5:53 pm, Shannon Sterz wrote:
> analogous to how this is handled in proxmox-backup-server.
> 
> Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
> ---
>  cli/admin/Cargo.toml  |  1 +
>  cli/admin/src/cert.rs | 86 +++++++++++++++++++++++++++++++++++++++++++
>  cli/admin/src/main.rs |  2 +
>  3 files changed, 89 insertions(+)
>  create mode 100644 cli/admin/src/cert.rs
> 
> diff --git a/cli/admin/Cargo.toml b/cli/admin/Cargo.toml
> index 01afc88d..db522696 100644
> --- a/cli/admin/Cargo.toml
> +++ b/cli/admin/Cargo.toml
> @@ -29,3 +29,4 @@ pdm-api-types.workspace = true
>  pdm-config.workspace = true
>  pdm-buildcfg.workspace = true
>  server.workspace = true
> +proxmox-time.workspace = true
> diff --git a/cli/admin/src/cert.rs b/cli/admin/src/cert.rs
> new file mode 100644
> index 00000000..6877c998
> --- /dev/null
> +++ b/cli/admin/src/cert.rs
> @@ -0,0 +1,86 @@
> +use anyhow::{Error, bail};
> +
> +use proxmox_router::cli::*;
> +use proxmox_schema::api;
> +use server::api;
> +use server::auth::certs::update_self_signed_cert;
> +use server::auth::csrf::generate_csrf_key;
> +use server::auth::key::generate_auth_key;
> +
> +#[api]
> +/// Display node certificate information.
> +fn cert_info() -> Result<(), Error> {
> +    let Some(cert) = api::nodes::certificates::get_info()?.pop() else {
> +        return Ok(());
> +    };
> +
> +    println!("Subject: {}", cert.subject);
> +
> +    for name in cert.san {
> +        println!("    {name}");
> +    }
> +
> +    let not_before = cert
> +        .notbefore
> +        .and_then(|e| proxmox_time::strftime_utc("%b %e %T %Y %Z", e).ok());
> +
> +    let not_after = cert
> +        .notafter
> +        .and_then(|e| proxmox_time::strftime_utc("%b %e %T %Y %Z", e).ok());
> +
> +    println!("Issuer: {}", cert.issuer);
> +    println!("Validity:");
> +    println!("    Not Before: {}", not_before.unwrap_or_default());
> +    println!("    Not After : {}", not_after.unwrap_or_default());
> +
> +    println!(
> +        "Fingerprint (sha256): {}",
> +        cert.fingerprint.unwrap_or_default()
> +    );
> +
> +    println!("Public key type: {}", cert.public_key_type);
> +    println!(
> +        "Public key bits: {}",
> +        cert.public_key_bits.unwrap_or_default()
> +    );
> +
> +    Ok(())
> +}
> +
> +#[api(
> +    input: {
> +        properties: {
> +            force: {
> +                description: "Force generation of new SSL certificate.",
> +                type:  Boolean,
> +                optional:true,
> +            },
> +        }
> +    },
> +)]
> +/// Update node certificates and generate all needed files/directories. If no authentication key or
> +/// CSRF secret key exists, this will also generate new ones. These two keys will go into effect the
> +/// next time the `proxmox-datacenter-api.service` is started.
> +fn update_certs(force: Option<bool>) -> Result<(), Error> {
> +    pdm_config::setup::create_configdir()?;
> +
> +    if let Err(err) = generate_auth_key() {
> +        bail!("unable to generate auth key - {err}");
> +    }
> +
> +    if let Err(err) = generate_csrf_key() {
> +        bail!("unable to generate csrf key - {err}");
> +    }
> +
> +    update_self_signed_cert(force.unwrap_or(false))?;
> +
> +    Ok(())
> +}
> +
> +pub fn cert_mgmt_cli() -> CommandLineInterface {
> +    let cmd_def = CliCommandMap::new()
> +        .insert("info", CliCommand::new(&API_METHOD_CERT_INFO))
> +        .insert("update", CliCommand::new(&API_METHOD_UPDATE_CERTS));
> +
> +    cmd_def.into()
> +}
> diff --git a/cli/admin/src/main.rs b/cli/admin/src/main.rs
> index 3102694e..a2c5c623 100644
> --- a/cli/admin/src/main.rs
> +++ b/cli/admin/src/main.rs
> @@ -13,6 +13,7 @@ use proxmox_schema::api;
>  use proxmox_sys::fs::CreateOptions;
>  
>  mod acme;
> +mod cert;
>  mod remotes;
>  mod support_status;
>  
> @@ -39,6 +40,7 @@ async fn run() -> Result<(), Error> {
>  
>      let cmd_def = CliCommandMap::new()
>          .insert("acme", acme::acme_mgmt_cli())
> +        .insert("cert", cert::cert_mgmt_cli())
>          .insert("remote", remotes::cli())
>          .insert(
>              "report",
> -- 
> 2.47.3
> 
> 
> 
> 
> 
>