Re: [RFC qemu-server 1/4] remote migrate: drop ineffective fingerprint auto-detection

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

On July 29, 2026 11:56 am, Fiona Ebner wrote:
> Am 21.07.26 um 1:58 PM schrieb Erik Fastermann:
>> When no fingerprint was supplied, the code fetched the remote node
>> certificate and pinned its fingerprint for the migration tunnel. This
>> has no functional effect and is removed.
>> 
>> That fetch only succeeds for remotes trusted via the CA store, which
>> is exactly the case where pinning is unnecessary: both the API client
>> and the websocket tunnel fall back to CA verification on their own.
>> For a self-signed remote the fetch itself fails verification, so no
>> fingerprint is ever obtained.
> 
> The websocket tunnel checks the pinned fingerprint against the one that
> was supplied, so with the current code any weird scenario where the
> fingerprint queried from the certificates API endpoint does not match
> the one gotten later by the websocket tunnel connection is caught. If
> you remove the pinning, such scenarios won't be caught anymore. Not sure
> how important that is though.
> 
> @Fabian what do you think?

Erik actually asked me about this before sending the RFC (@Erik - feel
free to mention such things in the "notes" part of a patch).

I don't think it really buys us much, and AFAICT it breaks in the
following case with a certificate trusted by the system:

- certificate info queried
- cert rotated
- websocket tunnel established -> wrong fingerprint

because the websocket tunnel will only check the fingerprint if one is
provided.

so IMHO, this should be removed.