Re: [PATCH proxmox-backup v3 05/16] config: use proxmox_tls_certificates for generating self-signed certificates

["Shannon Sterz" <s.sterz@proxmox.com>]

On Thu Aug 6, 2026 at 3:09 PM CEST, Fabian Grünbichler wrote:
> On August 5, 2026 5:52 pm, Shannon Sterz wrote:
>> to avoid duplicating almost identical code here, re-use the version
>> from `proxmox_tls_certificates::create_self_signed_cert`. for
>> `days_valid` specify `None` to opt into the default of 3650 days.
>
> since you write that it is "almost duplicate", a small summary of where
> they might differ would be great ;)
>
> AFAICT the switch from 1000 years -> 10 years is the only semantic
> change here?
>
> tbh I am not sure whether the behaviour of appending the search domain
> to the nodename (still) makes much sense, maybe the interface should
> rather be an additional list of SANs, and the caller can decide how to
> create them?
>
> for some products, we might want to specify them in a config file. for
> others, we might want to look them up via `hostname -f` and fallback to
> the search domain thing we've been doing historically? for some we might
> want to add IP addresses, for others we might not want that (and we
> definitely don't want to have "query IP" logic in
> proxmox-tls-certificates..)
>
> IMHO similar logic applies to the subject. that probably means we want
> some helpers to build a subject name (if we don't want to expose openssl
> types here). but then again, the helper we move to here is openssl
> specific anyway..

having a builder or similar here probably makes sense yes. and sorry for
the confusing phrasing, the real change is the 1000 years -> 10 years
change.

also as discussed off-line: adding an extension to newly generated
certificates to identify them as generated by us in the same step as
warning users about 1000 year valid certificates is probably preferable
over my approach of parsing the issuer in patch 03/16