Re: [PATCH proxmox{,-backup,-datacenter-manager} 0/7] acme: fix #6372 implement basic ARI support

["Shan Shaji" <s.shaji@proxmox.com>]

Hi,

I applied the patches and performed some testing with Proxmox Backup Server.

* In the UI, the force option is always set to true, so the lead-time check is
  skipped and a new certificate is ordered every time.
* I ordered a certificate through the UI, which generated a certificate valid from:

  2026-07-27 16:40:42 to 2026-10-25 15:40:41

* Then, tried to order the certificate using proxmox-backup-manager with
  the --force option set to false. The certificate was not renewed, and
  the renewal time from the suggested window was shown in the task log.
  However, it was not displayed in the console, as I mentioned in an
  earlier reply.

  Certificate is scheduled for renewal in 1M 4w 2d 8h 33m 13s by ARI

* Now deleted the custom certificate. Since PBS was now using the self-signed
  certificate, the initial ordering request failed because it included a
  certificate ID that the server could not parse. It then retried without the
  ARI certificate ID, and the request succeeded. Observed the same behavior
  when ordering through the CLI using proxmox-backup-manager, as long as
  the --force option was set to true.

  However, when --force is set to false, parsing the ARI certificate ID fails
  and the certificate is not created.

  TASK ERROR: urn:ietf:params:acme:error:malformed: Parsing ARI CertID failed: urn:ietf:params:acme:error:malformed :: Invalid path
  
  Shouldn't we also need to retry without the certificate ID in this case?
  I may have missed something, so please correct me if I am wrong.

Will do further testing tomorrow.

On Thu Jun 25, 2026 at 4:13 PM CEST, Manuel Federanko wrote:
>
> This series implements basic ACME ARI [0] support for Proxmox Backup
> Server and Proxmox Datacenter Manager. Currently both projects renew
> once a fixed time has passed:
>
[snip]