[PATCH manager 02/17] bin/api: add a new staged certificate when renewing self-signed cert

[Shannon Sterz <s.sterz@proxmox.com>]

when a certificate is about to expire (within the next four weeks, up
to two weeks before it expires), create a new staged "next"
certificate. by including this certificate when querying the api,
clients can prepare for when the certificate is about to be rotated.
allowing them to update to the new fingerprint, without needing an
additional out-of-band communication channel.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 PVE/API2/Certificates.pm |  5 ++++-
 PVE/CertHelpers.pm       |  6 ++++++
 bin/pveupdate            | 44 ++++++++++++++++++++++++++++++++--------
 3 files changed, 45 insertions(+), 10 deletions(-)

diff --git a/PVE/API2/Certificates.pm b/PVE/API2/Certificates.pm
index de8762c53..bcd650c3b 100644
--- a/PVE/API2/Certificates.pm
+++ b/PVE/API2/Certificates.pm
@@ -70,7 +70,10 @@ __PACKAGE__->register_method({
 
         my $res = [];
         my $cert_paths = [
-            '/etc/pve/pve-root-ca.pem', "$node_path/pve-ssl.pem", "$node_path/pveproxy-ssl.pem",
+            '/etc/pve/pve-root-ca.pem',
+            "$node_path/pve-ssl.pem",
+            "$node_path/pveproxy-ssl.pem",
+            "$node_path/pve-ssl-next.pem",
         ];
         for my $path (@$cert_paths) {
             eval {
diff --git a/PVE/CertHelpers.pm b/PVE/CertHelpers.pm
index 202dec0ee..4272eaf57 100644
--- a/PVE/CertHelpers.pm
+++ b/PVE/CertHelpers.pm
@@ -55,6 +55,12 @@ sub default_cert_path_prefix {
     return "/etc/pve/nodes/${node}/pve-ssl";
 }
 
+sub default_next_cert_path_prefix {
+    my ($node) = @_;
+
+    return "/etc/pve/nodes/${node}/pve-ssl-next";
+}
+
 sub cert_lock {
     my ($timeout, $code, @param) = @_;
 
diff --git a/bin/pveupdate b/bin/pveupdate
index b1960c353..0842ec893 100755
--- a/bin/pveupdate
+++ b/bin/pveupdate
@@ -103,10 +103,12 @@ syslog('err', "Renewing ACME certificate failed: $@") if $@;
 
 eval {
     my $certpath = PVE::CertHelpers::default_cert_path_prefix($nodename) . ".pem";
+    my $next_certpath = PVE::CertHelpers::default_next_cert_path_prefix($nodename) . ".pem";
     my $capath = "/etc/pve/pve-root-ca.pem";
+    my $now = time();
 
     my $renew = sub {
-        my ($msg) = @_;
+        my ($msg, $use_later) = @_;
 
         # get CA info
         my $cainfo = PVE::Certificate::get_certificate_info($capath);
@@ -127,19 +129,43 @@ eval {
         print "PVE certificate $msg\n";
         # create new certificate
         my $ip = PVE::Cluster::remote_node_ip($nodename);
-        PVE::Cluster::Setup::gen_pve_ssl_cert(1, $nodename, $ip);
 
-        print "Restarting pveproxy after renewing certificate\n";
-        PVE::Tools::run_command(['systemctl', 'reload-or-restart', 'pveproxy']);
+        if ($use_later) {
+            PVE::Cluster::Setup::gen_pve_ssl_cert(1, $nodename, $ip, $next_certpath);
+        } else {
+            PVE::Cluster::Setup::gen_pve_ssl_cert(1, $nodename, $ip);
+            print "Restarting pveproxy after renewing certificate\n";
+            PVE::Tools::run_command(['systemctl', 'reload-or-restart', 'pveproxy']);
+        }
     };
 
-    if (PVE::Certificate::check_expiry($certpath)) {
+    if (PVE::Certificate::check_expiry($certpath, $now)) {
         # already expired
         $renew->("expired, renewing...");
-    } elsif (PVE::Certificate::check_expiry($certpath, time() + 14 * 24 * 60 * 60)) {
-        # expires in next 2 weeks
-        $renew->("expires soon, renewing...");
-    } elsif (!PVE::Certificate::check_expiry($certpath, time() + 2 * 365 * 24 * 60 * 60)) {
+    } elsif (PVE::Certificate::check_expiry($certpath, $now + 14 * 24 * 60 * 60)) {
+        # expires in next 2 weeks, renew certificate if no "next" certificate already exists.
+        # rotate in the next certificate if it exists and does not expire.
+        if (
+            -f $next_certpath
+            && !PVE::Certificate::check_expiry($next_certpath, $now + 14 * 24 * 60 * 60)
+        ) {
+            rename($next_certpath, $certpath);
+            print "Restarting pveproxy after rotating certificate\n";
+            PVE::Tools::run_command(['systemctl', 'reload-or-restart', 'pveproxy']);
+        } else {
+            $renew->("expires soon, renewing...");
+
+            # clean up the now useless staged certificate, if there is one
+            if (-f $next_certpath) {
+                unlink $next_certpath
+                    or $!{ENOENT}
+                    or warn "failed to clean-up $next_certpath - $!\n";
+            }
+        }
+    } elsif (PVE::Certificate::check_expiry($certpath, $now + 28 * 24 * 60 * 60)) {
+        # expires in the next 4 weeks, create new cert, but don't use it yet
+        $renew->("staging new certificate...", 1);
+    } elsif (!PVE::Certificate::check_expiry($certpath, $now + 2 * 365 * 24 * 60 * 60)) {
         # expires in more than 2 years
         $renew->(
             "expires in more than 2 years, renewing to reduce certificate life-span for client compatibility..."
-- 
2.47.3