Re: [PATCH proxmox-backup 05/11] daily-update/docs: warn on excessive self-signed certificate lifetime

["Shannon Sterz" <s.sterz@proxmox.com>]

On Fri Jul 10, 2026 at 1:17 PM CEST, Lukas Wagner wrote:
> Just nit-picking here, but I think the daily-update part should be a
> separate commit.

ack, i'll split that then. i just thought it's such a minor change that
rolling it into once is easier.

> On Thu Jun 18, 2026 at 1:54 PM CEST, Shannon Sterz wrote:
>> and document how to renew it. an excessive lifetime is reported when
>> the lifetime of the certificate exceeds 3650 days (almost ten years),
>> which corresponds to the default lifetime generated by
>> proxmox-acme-api.
>>
>> Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
>> ---
>>  docs/certificate-management.rst | 31 +++++++++++++++++++++++++++++++
>>  src/bin/proxmox-daily-update.rs |  4 ++++
>>  2 files changed, 35 insertions(+)
>>
>> diff --git a/docs/certificate-management.rst b/docs/certificate-management.rst
>> index 89f628049..722d8d88b 100644
>> --- a/docs/certificate-management.rst
>> +++ b/docs/certificate-management.rst
>> @@ -333,3 +333,34 @@ Test your new certificate, using your browser.
>>
>>  .. [1]
>>     acme.sh https://github.com/acmesh-official/acme.sh
>> +
>> +Manually Renew Self-signed Certificates
>> +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> +
>> +Proxmox Backup Server creates and renews a self-signed certificate if no custom
>> +or ACME certificate is provided. Older versions issued a certificate that was
>> +valid for almost 1000 years and did not renew this certificate. Beginning with
>> +version 4.2, new setups use shorter lived certificates that will be regularly
>
> Should be 'shorter-lived' with a hyphen, I believe.

changed it to "short-lived" as i couldn't find much on the usage of
"shorter-lived".

also adjusted the version up there to 4.3 as 4.2 has since been
released.

>> +renewed. Old self-signed certificates are not replaced in order to not disrupt
>> +existing backup setups. In such cases, the following line is logged:
>> +
>> +.. code-block:: console
>> +
>> +   Apr 04 12:17:51 pbs proxmox-daily-update[1170]: Self-signed certificate is valid for an excessive amount of time. Please renew it.
>> +
>> +To manually renew a certificate, navigate to Configuration -> Certificates.
>> +Select the certificate ``proxy.pem``. Then click the "Delete Custom
>> +Certificate" button. Alternatively, you can run the following command:
>> +
>> +.. code-block:: shell
>> +
>> +   proxmox-backup-manager cert update --force
>> +
>> +.. WARNING:: Any client using a fingerprint to verify TLS sessions with the
>> +   server will need to be updated with the new fingerprint. This includes any
>> +   Proxmox VE instance that may use it as a backup destination.
>> +
>> +After manually renewing the certificate once, Proxmox Backup Server will start
>> +renewing the certificate itself. A certificate will be renewed at the earliest
>> +15 days before it expires. Starting from 30 days before it expires,
>> +notifications will be issued with a reminder about the upcoming renewal.
>> diff --git a/src/bin/proxmox-daily-update.rs b/src/bin/proxmox-daily-update.rs
>> index ffeb46e49..71fd653ce 100644
>> --- a/src/bin/proxmox-daily-update.rs
>> +++ b/src/bin/proxmox-daily-update.rs
>> @@ -113,6 +113,10 @@ async fn renew_self_signed_certificate() -> Result<(), Error> {
>>      } else if days <= 30 {
>>          log::info!("Certificate expires within 30 days, notify about renewal.");
>>          send_upcoming_self_signed_renewal_notification()?;
>> +   } else if days > 365 * 10 {
>> +        log::warn!(
>> +            "Self-signed certificate is valid for an excessive amount of time. Please renew it."
>> +        );
>>      }
>>
>>      Ok(())