[PATCH proxmox-acme v4 3/3] fix #5978: pem parser: relax parsing of chain entries:

[Thomas Ellmenreich <t.ellmenreich@proxmox.com>]

Instead of using a custom regex to parse pem chains, now uses
the pve-common Certificate::check_pem function to do so. This
now allows for additional text and whitespace inbetween the
chain entries.

Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
---
 src/PVE/ACME.pm | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
index e6fb9c2..665087b 100644
--- a/src/PVE/ACME.pm
+++ b/src/PVE/ACME.pm
@@ -526,14 +526,16 @@ sub get_certificate {
                     }
                 }
             }
-            die "no matching alternate chain for '$root' returned by server\n"
+            die "no matching alternate chain for '$root' provided by the acme server\n"
                 if !defined($res);
         }
 
-        if ($res =~ /^(-----BEGIN CERTIFICATE-----)(.+)(-----END CERTIFICATE-----)$/s) { # untaint
-            return $1 . $2 . $3;
-        }
-        die "Server reply does not look like a PEM encoded certificate\n";
+        my $parsed = eval { PVE::Certificate::check_pem($res, multiple => 1) };
+        chomp(my $error = $@);
+        die
+            "value returned by ACME certificate url does not look like a PEM encoded certificate: " . $error . "\n"
+            if $error;
+        return $parsed;
     };
     $self->fatal("POST of '$order->{certificate}' failed - $@", $r) if $@;
     return $return;
-- 
2.47.3