Re: [PATCH manager] certificate: make sure that any new certificate and key match

[Daniel Herzig <d.herzig@proxmox.com>]

Thanks for this!

I just built, installed and tested the package.

Works perfectly fine, as described in the commit message.

Tested-by: Daniel Herzig <d.herzig@proxmox.com>

Shannon Sterz <s.sterz@proxmox.com> writes:

> previously it was possible to upload and set a key and certificate
> combination, that did not match each other. this lead to confusing
> errors as pveproxy would seemingly start, but not actually serve any
> http connections. in a cluster context this leads to "broken pipe"
> errors when connecting to such a misconfigured node. since this is
> rather confusing, verify that a key and certificate can actually be
> used before setting them as the current certificates by loading them
> into a TLS context.
>
> Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
> ---
>
> Notes:
>     this came up in the enterprise support and caused quite a bit of
>     confusion.
>
>  PVE/CertHelpers.pm | 27 +++++++++++++++++++++++++++