partially-applied [PATCH cluster/common/datacenter-manager/manager/proxmox v2 00/16] TLS Certificate Staging

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

On Wed, 05 Aug 2026 15:18:23 +0200, Shannon Sterz wrote:
> the aim of this series is to allow clients to automatically adapt to regular
> certificate rotation. the top-level overview of the mechanism proposed here is
> as follows:
> 
> - hosts that rotate their certificate create a new certificate at the earliest
>   four weeks before their current certificate expires. this certificate is
>   considered as "staged" up until it becomes actively used.
> - clients can query a host for a staged certificate at any moment, the host
>   will provide information such as the fingerprint for the active and staged
>   certificate(s).
> - at the earliest two weeks before their current certificate expires, hosts may
>   start using the "staged" certificate. the two week window is needed to give
>   clients enough time to query a potential staged certificate.
> - clients, that use fingerprints to validate a TLS certificate, should discard
>   the previously used fingerprint and update to the new certificate's
>   fingerprint (the previously staged certificate) as soon as they detect its
>   usage. connections trying to authenticate themselves with the old certificate
>   should be rejected at this point.
> 
> [...]

Applied this one, thanks!

[13/16] server: remotes: lock remotes config when updating it
        commit: f157678707b86c486f47bd4992ae7eed717ecd42

Best regards,
-- 
Fabian Grünbichler <f.gruenbichler@proxmox.com>