Re: [PATCH datacenter-manager 08/11] api/auth/bin: add certificate renewal logic

["Shannon Sterz" <s.sterz@proxmox.com>]

On Fri Jul 10, 2026 at 1:17 PM CEST, Lukas Wagner wrote:
> On Thu Jun 18, 2026 at 1:54 PM CEST, Shannon Sterz wrote:
>> +    pub SELF_SIGNED_REGEX = concatcp!(
>> +        r#"^O\s?=\s?"#,
>> +        crate::auth::certs::PRODUCT_NAME,
>> +        r#", OU\s?=\s?[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}, CN\s?=\s?(?<fqdn>.*)$"#
>> +    );
>> +}
>> +
>>  pub const ROUTER: Router = Router::new()
>>      .get(&list_subdirs_api_method!(SUBDIRS))
>>      .subdirs(SUBDIRS);
>> @@ -247,6 +258,43 @@ pub fn cert_expires_soon() -> Result<bool, Error> {
>>          .map_err(|err| format_err!("Failed to check certificate expiration date: {}", err))
>>  }
>>
>> +/// Check whether the current certificate is self-signed and returns the remaining days the
>> +/// certificate is valid for.
>> +pub fn self_signed_cert_expires_in() -> Result<Option<i32>, Error> {
>
> This helper seems very similar to the one you added in PBS, would it
> make sense to move it to some shared crate?

i agree, but imo we currently don't have a nice place for things that
are tls certificate related, but make no sense in an acme specific
context. this is a problem also holding up other series in this space
like dominik's unify openssl callback series [1]. i started an internal
discussion about that, but until that is concluded i'd keep this code
as-is.

[1]: https://lore.proxmox.com/pbs-devel/20260701103120.1593265-2-d.csapak@proxmox.com/

>> +    let cert = get_certificate_info()?;
>> +
>> +    let Some(captures) = (SELF_SIGNED_REGEX.regex_obj)().captures(&cert.issuer) else {
>> +        return Ok(None);
>> +    };
>> +
>> +    let mut fqdn = proxmox_sys::nodename().to_owned();
>> +    let resolv_conf = read_etc_resolv_conf(None)?.config;
>> +
>> +    if let Some(domain) = resolv_conf.search {
>> +        fqdn.push('.');
>> +        fqdn.push_str(&domain);
>> +    }
>> +
>> +    if captures["fqdn"] != fqdn {
>> +        return Ok(None);
>> +    }
>> +
>> +    let now = Asn1Time::from_unix(proxmox_time::epoch_i64())?;
>> +    let not_after = Asn1Time::from_unix(cert.notafter.ok_or_else(|| {
>> +        format_err!("Could not get \"not after\" epoch for current certificate.")
>> +    })?)?;
>> +
>> +    let diff = now.diff(&not_after)?;
>> +    Ok(Some(diff.days))
>> +}