Re: [PATCH datacenter-manager 08/11] api/auth/bin: add certificate renewal logic

["Lukas Wagner" <l.wagner@proxmox.com>]

On Thu Jun 18, 2026 at 1:54 PM CEST, Shannon Sterz wrote:
> +    pub SELF_SIGNED_REGEX = concatcp!(
> +        r#"^O\s?=\s?"#,
> +        crate::auth::certs::PRODUCT_NAME,
> +        r#", OU\s?=\s?[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}, CN\s?=\s?(?<fqdn>.*)$"#
> +    );
> +}
> +
>  pub const ROUTER: Router = Router::new()
>      .get(&list_subdirs_api_method!(SUBDIRS))
>      .subdirs(SUBDIRS);
> @@ -247,6 +258,43 @@ pub fn cert_expires_soon() -> Result<bool, Error> {
>          .map_err(|err| format_err!("Failed to check certificate expiration date: {}", err))
>  }
>  
> +/// Check whether the current certificate is self-signed and returns the remaining days the
> +/// certificate is valid for.
> +pub fn self_signed_cert_expires_in() -> Result<Option<i32>, Error> {

This helper seems very similar to the one you added in PBS, would it
make sense to move it to some shared crate?

> +    let cert = get_certificate_info()?;
> +
> +    let Some(captures) = (SELF_SIGNED_REGEX.regex_obj)().captures(&cert.issuer) else {
> +        return Ok(None);
> +    };
> +
> +    let mut fqdn = proxmox_sys::nodename().to_owned();
> +    let resolv_conf = read_etc_resolv_conf(None)?.config;
> +
> +    if let Some(domain) = resolv_conf.search {
> +        fqdn.push('.');
> +        fqdn.push_str(&domain);
> +    }
> +
> +    if captures["fqdn"] != fqdn {
> +        return Ok(None);
> +    }
> +
> +    let now = Asn1Time::from_unix(proxmox_time::epoch_i64())?;
> +    let not_after = Asn1Time::from_unix(cert.notafter.ok_or_else(|| {
> +        format_err!("Could not get \"not after\" epoch for current certificate.")
> +    })?)?;
> +
> +    let diff = now.diff(&not_after)?;
> +    Ok(Some(diff.days))
> +}