From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id BA7481FF129 for ; Thu, 06 Aug 2026 15:49:53 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id AF2472152B; Thu, 06 Aug 2026 15:49:44 +0200 (CEST) Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Thu, 06 Aug 2026 15:49:49 +0200 Message-Id: Subject: Re: [PATCH proxmox v3 02/16] tls-certificates: add days_valid parameter to create_self_signed_cert To: =?utf-8?q?Fabian_Gr=C3=BCnbichler?= , X-Mailer: aerc 0.20.0 References: <20260805155308.519896-2-s.sterz@proxmox.com> <20260805155308.519896-4-s.sterz@proxmox.com> <1786021372.xnuxft8ug6.astroid@yuna.none> In-Reply-To: <1786021372.xnuxft8ug6.astroid@yuna.none> From: "Shannon Sterz" X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1786024174825 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.122 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: BCNPPSJJ7NCXIQEIQNBU53FQBM54NO56 X-Message-ID-Hash: BCNPPSJJ7NCXIQEIQNBU53FQBM54NO56 X-MailFrom: s.sterz@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Thu Aug 6, 2026 at 3:09 PM CEST, Fabian Gr=C3=BCnbichler wrote: > On August 5, 2026 5:52 pm, Shannon Sterz wrote: >> to allow specifying how long a certificate should be valid for. also >> adds unit tests to verify this behavior. >> >> Signed-off-by: Shannon Sterz >> --- >> >> Notes: >> imo, we could go down even more. as far as i am aware there is no re= al >> limit that is being enforced here for self-signed certificates from = a >> browser perspective. they are already trusted on an exemption-basis >> anyway. however, certificates signed by public CAs will only be vali= d >> for a maximum of 47 days by 2029 [1]. >> >> hence, i would personally either adopt the same limit or go down to = a >> year, as a sensible middle-ground. certificate rotation should reall= y >> be automated even in self-signed scenarios. we also had cases in the >> past, where customers already ran into an issue because they wanted = to >> limit the lifetime of their certificates below 30 days [2]. meaning >> that there is a need out there for shorter-lived certificates (thoug= h, >> in that case a custom CA & ACME setup was used). > > the main issue with decreasing the lifetime of the certificate is that > for PBS in particular, it needs to be pinned in potentially a lot of > places (that might not access the PBS system very often). > > so IMHO the order of application needs to be: > - this series with a lifetime roughly matching a deployment of a PBS > system > - implement staging support on the PBS server-side, and all clients > (PBS, PVE, PDM) > - wait (for clients to upgrade, including some time for external clients > to adapt as well > - reduce lifetime to a year (and maybe warning threshold for getting rid > of old, long-lived certificates) completely agree. imo 10 years is a reasonable time frame for this. that would 5 pbs releases or so. imo we can do the first three steps outlined here before pbs 5 drops and the decrease the lifetime with pbs 6 or 7. that should give enough time for everyone to adjust hopefully. if really required, users could still get a custom long-lived cert and use that instead. -->8 snip 8<--