[PATCH proxmox 01/10] acme-api: make self-signed certificate expiry configurable

[Shannon Sterz <s.sterz@proxmox.com>]

and change the default from 365000 days (almost 1000 years) to  3650
days (almost 10 years). almost 1000 years is excessive, as no
practical cryptographic key can reasonably be considered safe for that
amount of time. almost 10 years should still give plenty of time to
prepare for certificate changes.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---

Notes:
    imo, we could go down even more. as far as i am aware there is no real
    limit that is being enforced here for self-signed certificates from a
    browser perspective. they are already trusted on an exemption-basis
    anyway. however, certificates signed by public CAs will only be valid
    for a maximum of 47 days by 2029 [1].
    
    hence, i would personally either adopt the same limit or go down to a
    year, as a sensible middle-ground. certificate rotation should really
    be automated even in self-signed scenarios. we also had cases in the
    past, where customers already ran into issue because they wanted to
    limit the lifetime of their certificates below 30 days [2]. meaning
    that there is a need out there for shorter lived certificates (though,
    in that case a custom CA & ACME setup was used).
    
    [1]: https://github.com/cabforum/servercert/pull/553
    [2]: https://bugzilla.proxmox.com/show_bug.cgi?id=6372

 proxmox-acme-api/src/certificate_helpers.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/proxmox-acme-api/src/certificate_helpers.rs b/proxmox-acme-api/src/certificate_helpers.rs
index a4fe153a..c09bd65c 100644
--- a/proxmox-acme-api/src/certificate_helpers.rs
+++ b/proxmox-acme-api/src/certificate_helpers.rs
@@ -214,6 +214,7 @@ pub fn create_self_signed_cert(
     product_name: &str,
     nodename: &str,
     domain: Option<&str>,
+    expire: Option<u32>,
 ) -> Result<(PKey<Private>, X509), Error> {
     let rsa = Rsa::generate(4096).unwrap();
 
@@ -223,7 +224,7 @@ pub fn create_self_signed_cert(
 
     let today = openssl::asn1::Asn1Time::days_from_now(0)?;
     x509.set_not_before(&today)?;
-    let expire = openssl::asn1::Asn1Time::days_from_now(365 * 1000)?;
+    let expire = openssl::asn1::Asn1Time::days_from_now(expire.unwrap_or(365 * 10))?;
     x509.set_not_after(&expire)?;
 
     let mut fqdn = nodename.to_owned();
-- 
2.47.3