From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 232561FF13B for ; Wed, 22 Apr 2026 14:41:14 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 797661DF83; Wed, 22 Apr 2026 14:41:11 +0200 (CEST) From: Shannon Sterz To: pbs-devel@lists.proxmox.com Subject: [PATCH datacenter-manager 11/12] daily-update/docs: warn on excessive tls certificate validity periods Date: Wed, 22 Apr 2026 14:40:21 +0200 Message-ID: <20260422124022.17952-12-s.sterz@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260422124022.17952-1-s.sterz@proxmox.com> References: <20260422124022.17952-1-s.sterz@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1776861542028 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.122 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: VIW44VKDUQEDNXW6XINBA42PMSP3TJX3 X-Message-ID-Hash: VIW44VKDUQEDNXW6XINBA42PMSP3TJX3 X-MailFrom: s.sterz@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: and document how to update the certificate manually. an excessive lifetime is reported when the lifetime of the certificate exceeds 3650 days (almost ten years), which corresponds to the default lifetime generated by proxmox-acme-api. Signed-off-by: Shannon Sterz --- docs/certificate-management.rst | 31 +++++++++++++++++++ ...proxmox-datacenter-manager-daily-update.rs | 4 +++ 2 files changed, 35 insertions(+) diff --git a/docs/certificate-management.rst b/docs/certificate-management.rst index 652f6ca..680d8af 100644 --- a/docs/certificate-management.rst +++ b/docs/certificate-management.rst @@ -303,3 +303,34 @@ Test your new certificate, using your browser. .. [1] acme.sh https://github.com/acmesh-official/acme.sh + +Manually Renew Self-signed Certificates +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Proxmox Datacenter Manager creates and renews a self-signed certificate if no +custom or ACME certificate is provided. Older versions issued a certificate +that was valid for almost 1000 years and did not renew this certificate. +Beginning with version 1.1, new setups use shorter lived certificates that will +be regularly renewed. Old self-signed certificates are not replaced in order to +not disrupt existing setups. In such cases, the following line is +logged: + +.. code-block:: console + + Apr 04 12:17:51 pdm proxmox-datacenter-manager-daily-update[1170]: Self-signed certificate is valid for an excessive amount of time. Please renew it. + +To manually renew a certificate, navigate to Configuration -> Certificates. +Select the certificate ``proxy.pem``. Then click the "Delete Custom +Certificate" button. Alternatively, you can run the following command: + +.. code-block:: shell + + proxmox-datacenter-manager-admin cert update --force + +.. WARNING:: Any client using a fingerprint to verify TLS sessions with the + server will need to be updated with the new fingerprint. + +After manually renewing the certificate once, Proxmox Datacenter Manager will +start renewing the certificate itself. A certificate will be renewed at the +earliest 15 days before it expires. Starting from 30 days before it expires, +notifications will be issued with a reminder about the upcoming renewal. diff --git a/server/src/bin/proxmox-datacenter-manager-daily-update.rs b/server/src/bin/proxmox-datacenter-manager-daily-update.rs index deed0be..8e5f67a 100644 --- a/server/src/bin/proxmox-datacenter-manager-daily-update.rs +++ b/server/src/bin/proxmox-datacenter-manager-daily-update.rs @@ -108,6 +108,10 @@ async fn renew_self_signed_certificate() -> Result<(), Error> { } else if days <= 30 { log::info!("Certificate expires within 30 days."); // fixme: send_upcoming_self_signed_renewal_notification()?; + } else if days > 365 * 10 { + log::warn!( + "Self-signed certificate is valid for an excessive amount of time. Please renew it." + ); } Ok(()) -- 2.47.3