From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 8BDCC1FF129 for ; Thu, 06 Aug 2026 15:49:41 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 2D5DA2152A; Thu, 06 Aug 2026 15:49:32 +0200 (CEST) Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Thu, 06 Aug 2026 15:49:38 +0200 Message-Id: Subject: Re: [PATCH proxmox-backup v3 05/16] config: use proxmox_tls_certificates for generating self-signed certificates To: =?utf-8?q?Fabian_Gr=C3=BCnbichler?= , X-Mailer: aerc 0.20.0 References: <20260805155308.519896-2-s.sterz@proxmox.com> <20260805155308.519896-7-s.sterz@proxmox.com> <1786019814.dpgzjo6tpu.astroid@yuna.none> In-Reply-To: <1786019814.dpgzjo6tpu.astroid@yuna.none> From: "Shannon Sterz" X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1786024163263 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.124 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: QPDBXYIXCO3NBNWZSAPPJVIV3IJV2GTM X-Message-ID-Hash: QPDBXYIXCO3NBNWZSAPPJVIV3IJV2GTM X-MailFrom: s.sterz@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Thu Aug 6, 2026 at 3:09 PM CEST, Fabian Gr=C3=BCnbichler wrote: > On August 5, 2026 5:52 pm, Shannon Sterz wrote: >> to avoid duplicating almost identical code here, re-use the version >> from `proxmox_tls_certificates::create_self_signed_cert`. for >> `days_valid` specify `None` to opt into the default of 3650 days. > > since you write that it is "almost duplicate", a small summary of where > they might differ would be great ;) > > AFAICT the switch from 1000 years -> 10 years is the only semantic > change here? > > tbh I am not sure whether the behaviour of appending the search domain > to the nodename (still) makes much sense, maybe the interface should > rather be an additional list of SANs, and the caller can decide how to > create them? > > for some products, we might want to specify them in a config file. for > others, we might want to look them up via `hostname -f` and fallback to > the search domain thing we've been doing historically? for some we might > want to add IP addresses, for others we might not want that (and we > definitely don't want to have "query IP" logic in > proxmox-tls-certificates..) > > IMHO similar logic applies to the subject. that probably means we want > some helpers to build a subject name (if we don't want to expose openssl > types here). but then again, the helper we move to here is openssl > specific anyway.. having a builder or similar here probably makes sense yes. and sorry for the confusing phrasing, the real change is the 1000 years -> 10 years change. also as discussed off-line: adding an extension to newly generated certificates to identify them as generated by us in the same step as warning users about 1000 year valid certificates is probably preferable over my approach of parsing the issuer in patch 03/16