Re: [PATCH pve-cluster v3 2/3] Convert SSL cert generation config to CLI arguments

[Thomas Lamprecht <t.lamprecht@proxmox.com>]

Am 17.03.26 um 15:22 schrieb Arthur Bied-Charreton:
> Replace temporary OpenSSL config file with direct CLI arguments in PVE
> node SSL cert generation.
> 
> Changes:
> - Use '-subj' flag for distinguished name
> - Use '-addext' flag for cert extensions
> - Use '-copy_extensions copyall' to copy extensions from CSR to cert
> - Remove temp config file and cleanup code

IMO an odd way to write a commit message, especially as I can see most of
that from checking the, well, actual changes below... And only some parts
got picked out.

Also, the 2048 bit is just silently dropped, is that implied somewhere?
Such things should be actually mentioned. Please recheck all settings
yourself to ensure this is a complete change.

> As suggested here:
> https://lore.proxmox.com/pve-devel/20260123195300.0ae7fcc9@rosa.proxmox.com/T/#t

would be good to include some actual rationale, not just the link, as
unlike the changes described above I cannot just get that from the diff
or rest of the commit's info.



> 
> Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
> ---
>  src/PVE/Cluster/Setup.pm | 41 +++++++++-------------------------------
>  1 file changed, 9 insertions(+), 32 deletions(-)
> 
> diff --git a/src/PVE/Cluster/Setup.pm b/src/PVE/Cluster/Setup.pm
> index 4f528ba..b9cacfd 100644
> --- a/src/PVE/Cluster/Setup.pm
> +++ b/src/PVE/Cluster/Setup.pm
> @@ -504,33 +504,6 @@ sub gen_pve_ssl_cert {
>          $names .= ",DNS:$fqdn";
>      }
>  
> -    my $sslconf = <<__EOD;
> -RANDFILE = /root/.rnd
> -extensions = v3_req
> -
> -[ req ]
> -default_bits = 2048
> -distinguished_name = req_distinguished_name
> -req_extensions = v3_req
> -prompt = no
> -string_mask = nombstr
> -
> -[ req_distinguished_name ]
> -organizationalUnitName = PVE Cluster Node
> -organizationName = Proxmox Virtual Environment
> -commonName = $fqdn
> -
> -[ v3_req ]
> -basicConstraints = CA:FALSE
> -extendedKeyUsage = serverAuth
> -subjectAltName = $names
> -__EOD
> -
> -    my $cfgfn = "/tmp/pvesslconf-$$.tmp";
> -    my $fh = IO::File->new($cfgfn, "w");
> -    print $fh $sslconf;
> -    close($fh);
> -
>      my $reqfn = "/tmp/pvecertreq-$$.tmp";
>      unlink $reqfn;
>  
> @@ -541,18 +514,23 @@ __EOD
>              'req',
>              '-batch',
>              '-new',
> -            '-config',
> -            $cfgfn,
>              '-key',
>              $pvessl_key_fn,
>              '-out',
>              $reqfn,
> +            '-subj',
> +            "/OU=PVE Cluster Node/O=Proxmox Virtual Environment/CN=$fqdn",
> +            '-addext',
> +            'basicConstraints=CA:FALSE',
> +            '-addext',
> +            'extendedKeyUsage=serverAuth',
> +            '-addext',
> +            "subjectAltName=$names",
>          ]);
>      };
>  
>      if (my $err = $@) {
>          unlink $reqfn;
> -        unlink $cfgfn;
>          die "unable to generate pve certificate request:\n$err";
>      }
>  
> @@ -581,13 +559,12 @@ __EOD
>              'openssl', 'x509', '-req', '-in', $reqfn, '-days', $daysleft, '-out',
>              $pvessl_cert_fn,
>              '-CAkey', $pveca_key_fn, '-CA', $pveca_cert_fn, '-CAserial', $pveca_srl_fn,
> -            '-extfile', $cfgfn,
> +            '-copy_extensions', 'copyall',
>          ]);
>      };
>      my $err = $@;
>  
>      unlink $reqfn or $!{ENOENT} or warn "failed to clean up '$reqfn' - $!";
> -    unlink $cfgfn or $!{ENOENT} or warn "failed to clean up '$cfgfn' - $!";
>  
>      die "unable to generate pve ssl certificate:\n$err" if $err;
>  }