From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 683A21FF0E1 for ; Mon, 27 Jul 2026 18:16:27 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id C895D214FA; Mon, 27 Jul 2026 18:16:26 +0200 (CEST) Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Mon, 27 Jul 2026 18:15:52 +0200 Message-Id: Subject: Re: [PATCH proxmox{,-backup,-datacenter-manager} 0/7] acme: fix #6372 implement basic ARI support From: "Shan Shaji" To: "Manuel Federanko" , , X-Mailer: aerc 0.20.0 References: <20260625141337.181684-1-m.federanko@proxmox.com> In-Reply-To: <20260625141337.181684-1-m.federanko@proxmox.com> X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1785168917548 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.133 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: CYBVDKVVKR2JTO2R3263E3DKB7HC6IPN X-Message-ID-Hash: CYBVDKVVKR2JTO2R3263E3DKB7HC6IPN X-MailFrom: s.shaji@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Datacenter Manager development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Hi, I applied the patches and performed some testing with Proxmox Backup Server= . * In the UI, the force option is always set to true, so the lead-time check= is skipped and a new certificate is ordered every time. * I ordered a certificate through the UI, which generated a certificate val= id from: 2026-07-27 16:40:42 to 2026-10-25 15:40:41 * Then, tried to order the certificate using proxmox-backup-manager with the --force option set to false. The certificate was not renewed, and the renewal time from the suggested window was shown in the task log. However, it was not displayed in the console, as I mentioned in an earlier reply. Certificate is scheduled for renewal in 1M 4w 2d 8h 33m 13s by ARI * Now deleted the custom certificate. Since PBS was now using the self-sign= ed certificate, the initial ordering request failed because it included a certificate ID that the server could not parse. It then retried without t= he ARI certificate ID, and the request succeeded. Observed the same behavior when ordering through the CLI using proxmox-backup-manager, as long as the --force option was set to true. However, when --force is set to false, parsing the ARI certificate ID fai= ls and the certificate is not created. TASK ERROR: urn:ietf:params:acme:error:malformed: Parsing ARI CertID fail= ed: urn:ietf:params:acme:error:malformed :: Invalid path =20 Shouldn't we also need to retry without the certificate ID in this case? I may have missed something, so please correct me if I am wrong. Will do further testing tomorrow. On Thu Jun 25, 2026 at 4:13 PM CEST, Manuel Federanko wrote: > > This series implements basic ACME ARI [0] support for Proxmox Backup > Server and Proxmox Datacenter Manager. Currently both projects renew > once a fixed time has passed: > [snip]