Re: [RFC qemu-server 1/4] remote migrate: drop ineffective fingerprint auto-detection

[Fiona Ebner <f.ebner@proxmox.com>]

Am 29.07.26 um 12:06 PM schrieb Fabian Grünbichler:
> On July 29, 2026 11:56 am, Fiona Ebner wrote:
>> Am 21.07.26 um 1:58 PM schrieb Erik Fastermann:
>>> When no fingerprint was supplied, the code fetched the remote node
>>> certificate and pinned its fingerprint for the migration tunnel. This
>>> has no functional effect and is removed.
>>>
>>> That fetch only succeeds for remotes trusted via the CA store, which
>>> is exactly the case where pinning is unnecessary: both the API client
>>> and the websocket tunnel fall back to CA verification on their own.
>>> For a self-signed remote the fetch itself fails verification, so no
>>> fingerprint is ever obtained.
>>
>> The websocket tunnel checks the pinned fingerprint against the one that
>> was supplied, so with the current code any weird scenario where the
>> fingerprint queried from the certificates API endpoint does not match
>> the one gotten later by the websocket tunnel connection is caught. If
>> you remove the pinning, such scenarios won't be caught anymore. Not sure
>> how important that is though.
>>
>> @Fabian what do you think?
> 
> Erik actually asked me about this before sending the RFC (@Erik - feel
> free to mention such things in the "notes" part of a patch).
> 
> I don't think it really buys us much, and AFAICT it breaks in the
> following case with a certificate trusted by the system:
> 
> - certificate info queried
> - cert rotated
> - websocket tunnel established -> wrong fingerprint
> 
> because the websocket tunnel will only check the fingerprint if one is
> provided.
> 
> so IMHO, this should be removed.

Ack, sounds good :)