From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id DCB1D1FF142 for ; Tue, 07 Apr 2026 15:57:22 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 717391CF0C; Tue, 7 Apr 2026 15:57:55 +0200 (CEST) From: Shannon Sterz To: pbs-devel@lists.proxmox.com Subject: [PATCH datacenter-manager 10/10] daily-update/docs: warn on excessive tls certificate validity periods Date: Tue, 7 Apr 2026 15:57:14 +0200 Message-ID: <20260407135714.490747-11-s.sterz@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260407135714.490747-1-s.sterz@proxmox.com> References: <20260407135714.490747-1-s.sterz@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1775570173021 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.125 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 6U3GIJD3FXYANDGJIWQ4XDD4S7ZJGAKK X-Message-ID-Hash: 6U3GIJD3FXYANDGJIWQ4XDD4S7ZJGAKK X-MailFrom: s.sterz@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: and document how to update the certificate manually. an excessive lifetime is reported when the lifetime of the certificate exceeds 3650 days (almost ten years), which corresponds to the default lifetime generated by proxmox-acme-api. Signed-off-by: Shannon Sterz --- docs/certificate-management.rst | 31 +++++++++++++++++++ ...proxmox-datacenter-manager-daily-update.rs | 4 +++ 2 files changed, 35 insertions(+) diff --git a/docs/certificate-management.rst b/docs/certificate-management.rst index 652f6ca..a9a12cf 100644 --- a/docs/certificate-management.rst +++ b/docs/certificate-management.rst @@ -303,3 +303,34 @@ Test your new certificate, using your browser. .. [1] acme.sh https://github.com/acmesh-official/acme.sh + +Manually Renew Self-signed Certificates +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Proxmox Datacenter Manager creates and renews a self-signed certificate if no +custom or ACME certificate is provided. Older versions issued a certificate +that was valid for almost 1000 years and did not renew this certificate. +Beginning with version 1.1, new setups use shorter lived certificates that will +be regularly renewed. Old self-signed certificates are not replaced in order to +not disrupt existing backup setups. In such cases, the following line is +logged: + +.. code-block:: console + + Apr 04 12:17:51 pdm proxmox-datacenter-manager-daily-update[1170]: Self-signed certificate is valid for an excessive amount of time. Please renew it. + +To manually renew a certificate, navigate to Configuration -> Certificates. +Select the certificate ``proxy.pem``. Then click the "Delete Custom +Certificate" button. Alternatively, you can run the following command: + +.. code-block:: shell + + proxmox-datacenter-manager-admin cert update --force + +.. WARNING:: Any client using a fingerprint to verify TLS sessions with the + server will need to be updated with the new fingerprint. + +After manually renewing the certificate once, Proxmox Datacenter Manager will +start renewing the certificate itself. A certificate will be renewed at the +earliest 15 days before it expires. Starting from 30 days before it expires, +notifications will be issued with a reminder about the upcoming renewal. diff --git a/server/src/bin/proxmox-datacenter-manager-daily-update.rs b/server/src/bin/proxmox-datacenter-manager-daily-update.rs index deed0be..8e5f67a 100644 --- a/server/src/bin/proxmox-datacenter-manager-daily-update.rs +++ b/server/src/bin/proxmox-datacenter-manager-daily-update.rs @@ -108,6 +108,10 @@ async fn renew_self_signed_certificate() -> Result<(), Error> { } else if days <= 30 { log::info!("Certificate expires within 30 days."); // fixme: send_upcoming_self_signed_renewal_notification()?; + } else if days > 365 * 10 { + log::warn!( + "Self-signed certificate is valid for an excessive amount of time. Please renew it." + ); } Ok(()) -- 2.47.3