From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id A5E381FF0E2 for ; Thu, 30 Jul 2026 15:32:39 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 3D243215D1; Thu, 30 Jul 2026 15:32:21 +0200 (CEST) From: Shannon Sterz To: pbs-devel@lists.proxmox.com Subject: [PATCH datacenter-manager 12/16] api/auth/bin: add certificate renewal logic Date: Thu, 30 Jul 2026 15:31:54 +0200 Message-ID: <20260730133158.418015-13-s.sterz@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260730133158.418015-1-s.sterz@proxmox.com> References: <20260730133158.418015-1-s.sterz@proxmox.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1785418314048 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.122 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: JQOE3QAT4RL4B3GVMLWGW4EL3ABRJ4SE X-Message-ID-Hash: JQOE3QAT4RL4B3GVMLWGW4EL3ABRJ4SE X-MailFrom: s.sterz@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: the daily-update service is used to check whether a self-signed certificate is in use and renews it if it would expire within the next 15 days. a self-signed certificate is detected by parsing the issuer field of the certificate. if it aligns with how self-signed certificates are created by this instance of proxmox datacenter manager, it will be deemed self-signed. 15 days was chosen as that should give a reasonable trade-off between not failing if the daily-update service can't run on the specific day that the certificate would expire and not refreshing the certificate too often. note that 15 days before expiry corresponds to let's encrypt's recommendation for when to update new certificates that are valid for 45 days: > Acceptable behavior includes renewing certificates at approximately > two thirds of the way through the current certificate’s lifetime. > > - https://letsencrypt.org/2025/12/02/from-90-to-45#action-required 15 days before expiry is about two thirds of the lifetime of a certificate that lasts for 45 days. Signed-off-by: Shannon Sterz --- server/src/api/nodes/certificates.rs | 19 +++++------ server/src/auth/certs.rs | 16 ++++++++- ...proxmox-datacenter-manager-daily-update.rs | 34 +++++++++++++++++++ 3 files changed, 57 insertions(+), 12 deletions(-) diff --git a/server/src/api/nodes/certificates.rs b/server/src/api/nodes/certificates.rs index 0f391499..515c4802 100644 --- a/server/src/api/nodes/certificates.rs +++ b/server/src/api/nodes/certificates.rs @@ -15,7 +15,7 @@ use proxmox_schema::api_types::NODE_SCHEMA; use pdm_api_types::PRIV_SYS_MODIFY; -use crate::auth::certs::{API_CERT_FN, API_KEY_FN}; +use crate::auth::certs::{API_CERT_FN, API_KEY_FN, get_certificate_info, get_certificate_pem}; pub const ROUTER: Router = Router::new() .get(&list_subdirs_api_method!(SUBDIRS)) @@ -43,16 +43,6 @@ const ACME_SUBDIRS: SubdirMap = &[( .put(&API_METHOD_RENEW_ACME_CERT), )]; -fn get_certificate_pem() -> Result, Error> { - let cert_pem = proxmox_sys::fs::file_get_contents(API_CERT_FN)?; - Ok(cert_pem) -} - -fn get_certificate_info() -> Result { - let cert_pem = get_certificate_pem()?; - CertificateInfo::from_pem("proxy.pem", &cert_pem) -} - #[api( input: { properties: { @@ -247,6 +237,13 @@ pub fn cert_expires_soon() -> Result { .map_err(|err| format_err!("Failed to check certificate expiration date: {}", err)) } +/// Renews the self signed certificate. The caller needs to make sure the current certificate is +/// really a self-signed certificate and not an ACME or custom certificate. +pub async fn renew_self_signed_cert() -> Result<(), Error> { + crate::auth::certs::update_self_signed_cert(true)?; + crate::reload_api_certificate().await +} + fn spawn_certificate_worker( name: &'static str, force: bool, diff --git a/server/src/auth/certs.rs b/server/src/auth/certs.rs index c208cf4f..4c7cafcb 100644 --- a/server/src/auth/certs.rs +++ b/server/src/auth/certs.rs @@ -2,11 +2,13 @@ use anyhow::{Error, format_err}; use std::path::PathBuf; use proxmox_dns_api::read_etc_resolv_conf; +use proxmox_tls_certificates::CertificateInfo; use pdm_buildcfg::configdir; pub const API_KEY_FN: &str = configdir!("/auth/api.key"); pub const API_CERT_FN: &str = configdir!("/auth/api.pem"); +pub const PRODUCT_NAME: &str = "Proxmox Datacenter Manager"; /// Update self signed node certificate. pub fn update_self_signed_cert(force: bool) -> Result<(), Error> { @@ -20,7 +22,7 @@ pub fn update_self_signed_cert(force: bool) -> Result<(), Error> { let resolv_conf = read_etc_resolv_conf(None)?.config; let (priv_key, cert) = proxmox_tls_certificates::create_self_signed_cert( - "Proxmox Datacenter Manager", + PRODUCT_NAME, proxmox_sys::nodename(), resolv_conf.search.as_deref(), None, @@ -45,3 +47,15 @@ pub(crate) fn set_api_certificate(cert_pem: &[u8], key_pem: &[u8]) -> Result<(), Ok(()) } + +/// Get the certificate as bytes in PEM format. +pub fn get_certificate_pem() -> Result, Error> { + let cert_pem = proxmox_sys::fs::file_get_contents("proxy.pem")?; + Ok(cert_pem) +} + +/// Get the `CertificateInfo` struct for the current certificate. +pub fn get_certificate_info() -> Result { + let cert_pem = get_certificate_pem()?; + CertificateInfo::from_pem(API_CERT_FN, &cert_pem) +} diff --git a/server/src/bin/proxmox-datacenter-manager-daily-update.rs b/server/src/bin/proxmox-datacenter-manager-daily-update.rs index 314b3399..803b2fc0 100644 --- a/server/src/bin/proxmox-datacenter-manager-daily-update.rs +++ b/server/src/bin/proxmox-datacenter-manager-daily-update.rs @@ -59,6 +59,11 @@ async fn do_update(rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> { log::error!("error checking certificates: {err}"); } + println!("check if self-signed certificate requires renewal"); + if let Err(err) = renew_self_signed_certificate().await { + log::error!("error checking self-signed certificate renewal: {err:#}"); + } + // TODO: cleanup tasks like in PVE? Ok(()) @@ -87,6 +92,35 @@ async fn check_acme_certificates(rpcenv: &mut dyn RpcEnvironment) -> Result<(), Ok(()) } +async fn renew_self_signed_certificate() -> Result<(), Error> { + let days = match proxmox_tls_certificates::self_signed_cert_expires_in( + server::auth::certs::PRODUCT_NAME, + proxmox_sys::nodename(), + proxmox_dns_api::read_etc_resolv_conf(None)? + .config + .search + .as_deref(), + server::auth::certs::get_certificate_info()?, + )? { + None => { + log::debug!("Certificate is not self-signed, nothing to do."); + return Ok(()); + } + Some(days) => days, + }; + + if days <= 15 { + log::info!("Certificate expires within 15 days, renewing certificate..."); + let _err = &api::nodes::certificates::renew_self_signed_cert().await; + // fixme: send_self_signed_renewal_notification(&err)?; + } else if days <= 30 { + log::info!("Certificate expires within 30 days."); + // fixme: send_upcoming_self_signed_renewal_notification(earliest_renewal)?; + } + + Ok(()) +} + async fn run(rpcenv: &mut dyn RpcEnvironment) -> Result<(), Error> { let api_user = pdm_config::api_user()?; let file_opts = CreateOptions::new().owner(api_user.uid).group(api_user.gid); -- 2.47.3