Re: [PATCH proxmox 01/11] acme-api: make self-signed certificate expiry configurable

["Shannon Sterz" <s.sterz@proxmox.com>]

On Fri Jul 10, 2026 at 1:15 PM CEST, Lukas Wagner wrote:
> Hi Shannon,
>
> thanks for the patch. Some notes inline.

Thanks for the review!

>
> On Thu Jun 18, 2026 at 1:54 PM CEST, Shannon Sterz wrote:
>> and change the default from 365000 days (almost 1000 years) to  3650
>> days (almost 10 years). almost 1000 years is excessive, as no
>> practical cryptographic key can reasonably be considered safe for that
>> amount of time. almost 10 years should still give plenty of time to
>> prepare for certificate changes.
>>
>> Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
>> ---
>>
>> Notes:
>>     imo, we could go down even more. as far as i am aware there is no real
>>     limit that is being enforced here for self-signed certificates from a
>>     browser perspective. they are already trusted on an exemption-basis
>>     anyway. however, certificates signed by public CAs will only be valid
>>     for a maximum of 47 days by 2029 [1].
>>
>>     hence, i would personally either adopt the same limit or go down to a
>>     year, as a sensible middle-ground. certificate rotation should really
>>     be automated even in self-signed scenarios. we also had cases in the
>>     past, where customers already ran into issue because they wanted to
>>     limit the lifetime of their certificates below 30 days [2]. meaning
>>     that there is a need out there for shorter lived certificates (though,
>>     in that case a custom CA & ACME setup was used).
>>
>>     [1]: https://github.com/cabforum/servercert/pull/553
>>     [2]: https://bugzilla.proxmox.com/show_bug.cgi?id=6372
>>
>>  proxmox-acme-api/src/certificate_helpers.rs | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/proxmox-acme-api/src/certificate_helpers.rs b/proxmox-acme-api/src/certificate_helpers.rs
>> index 3921b18e..9c55d30e 100644
>> --- a/proxmox-acme-api/src/certificate_helpers.rs
>> +++ b/proxmox-acme-api/src/certificate_helpers.rs
>
> Please use this opportunity to add a doc-string for this function which
> also documents this new parameter.

done.

>> @@ -214,6 +214,7 @@ pub fn create_self_signed_cert(
>>      product_name: &str,
>>      nodename: &str,
>>      domain: Option<&str>,
>> +    expire: Option<u32>,
>
> Maybe change the name in such a way that it's clear that this is
>   - a duration (not a timestamp)
>   - measured in days
>
> e.g. `expiry_in_days` (there might be better choices)
>
> Maybe it would even be a good idea to use the 'Duration' type here? I
> guess then the name could stay the same, since the type encodes the
> semantics quite nicely.
>
> Duration::from_days is still only in nightly, so instantiating it via
> Duration::from_secs for now is a bit awkward for this situation,
> admittedly.
>
> https://doc.rust-lang.org/beta/std/time/struct.Duration.html#method.from_days

i went with `days_valid` for now as it's a little shorter and conveys
the meaning appropriately in my opinion.

>>  ) -> Result<(PKey<Private>, X509), Error> {
>>      let rsa = Rsa::generate(4096).unwrap();
>>
>> @@ -223,7 +224,7 @@ pub fn create_self_signed_cert(
>>
>>      let today = openssl::asn1::Asn1Time::days_from_now(0)?;
>>      x509.set_not_before(&today)?;
>> -    let expire = openssl::asn1::Asn1Time::days_from_now(365 * 1000)?;
>> +    let expire = openssl::asn1::Asn1Time::days_from_now(expire.unwrap_or(365 * 10))?;
>>      x509.set_not_after(&expire)?;
>>
>>      let mut fqdn = nodename.to_owned();
>
>
> Also would not hurt to use this opportunity to implement a simple
> unit-test for this function, which (at least) tests that the expiry is
> set correctly. I think this crate should already have all the needed
> helpers to parse and verify the generated cert in a test?

ack, added three unit tests that should cover the four different
scenarios of input parameters (product_name and nodename only;
product_name, nodename and domain; product_name, nodename and
days_valid; product_name, nodename, domain and days_valid).