From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 43DF01FF09B for ; Mon, 14 Sep 2026 18:19:53 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id C5C56215FA; Mon, 14 Sep 2026 18:19:48 +0200 (CEST) From: Samuel Rufinatscha To: pdm-devel@lists.proxmox.com Subject: [PATCH proxmox 0/3] fix #7166: acme: stop and time out stalled certificate orders Date: Mon, 14 Sep 2026 18:19:28 +0200 Message-ID: <20260914161931.380138-1-s.rufinatscha@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1789402768932 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.400 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: ANVE3623LZSCFSUVPVG3A3FPJSW6THYB X-Message-ID-Hash: ANVE3623LZSCFSUVPVG3A3FPJSW6THYB X-MailFrom: s.rufinatscha@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Datacenter Manager development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Certificate orders can get stuck waiting for the CA and clicking on stop does not end the task [0]. With HTTP-01, the task also keeps port 80 busy, so another order fails with "Address already in use". This series makes validation and finalization abortable and gives each domain's validation and order finalization five minutes to finish. The validation timeout starts after plugin setup to preserve configured DNS propagation waits. The plugin is cleaned up on cancellation or timeout. Testing: Reproduced the issue on latest PDM with Pebble v2.10.1 by delaying HTTP-01 validation and pausing the CA during finalization. Tasks ignored Stop and kept running. With the patches applied, tasks stopped promptly on request or timed out after five minutes, releasing port 80. Certificate ordering and renewal still worked. Maintainer notes: * both PBS and PDM require the updated dependency [0] https://bugzilla.proxmox.com/show_bug.cgi?id=7166 proxmox: Samuel Rufinatscha (3): acme-api: extract certificate order finalization helper fix #7166: acme-api: allow stopping certificate orders fix #7166: acme-api: time out validation and finalization proxmox-acme-api/src/certificate_helpers.rs | 39 ++++++++++++++++----- 1 file changed, 31 insertions(+), 8 deletions(-) Summary over all repositories: 1 files changed, 31 insertions(+), 8 deletions(-) -- Generated by git-murpp 0.8.1