* superseded: [PATCH common/proxmox-acme v2 0/2] fix #5978: pem parser: relax parsing of chain entries
2026-06-17 12:42 14% [PATCH common/proxmox-acme v2 " Thomas Ellmenreich
` (2 preceding siblings ...)
2026-06-17 13:21 5% ` [PATCH common/proxmox-acme v2 0/2] fix #5978: pem parser: relax parsing of chain entries Shannon Sterz
@ 2026-07-03 10:57 5% ` Thomas Ellmenreich
3 siblings, 0 replies; 19+ results
From: Thomas Ellmenreich @ 2026-07-03 10:57 UTC (permalink / raw)
To: pve-devel
superseded-by v3:
https://lore.proxmox.com/pve-devel/20260703105133.77817-1-t.ellmenreich@proxmox.com/
^ permalink raw reply [relevance 5%]
* [PATCH common v3 1/2] fix #5978: pem parser: relax parsing of chain entries
2026-07-03 10:51 13% [PATCH common/proxmox-acme v3 " Thomas Ellmenreich
@ 2026-07-03 10:51 2% ` Thomas Ellmenreich
2026-07-03 10:51 5% ` [PATCH proxmox-acme v3 2/2] fix #5978: pem parser: relax parsing of chain entries: Thomas Ellmenreich
1 sibling, 0 replies; 19+ results
From: Thomas Ellmenreich @ 2026-07-03 10:51 UTC (permalink / raw)
To: pve-devel; +Cc: Thomas Ellmenreich
Relaxes the parser to allow for text and whitespaces inbetween certchain
entries. The splitting of PEM chains was also reworked to split each entry at
its end, grouping it with its leading text.
Added testsuite to cover a number of parsing edge cases.
Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
---
src/PVE/Certificate.pm | 37 ++++-
test/Makefile | 2 +
test/check_pem_test.pl | 357 +++++++++++++++++++++++++++++++++++++++++
test/split_pem_test.pl | 279 ++++++++++++++++++++++++++++++++
4 files changed, 667 insertions(+), 8 deletions(-)
create mode 100755 test/check_pem_test.pl
create mode 100755 test/split_pem_test.pl
diff --git a/src/PVE/Certificate.pm b/src/PVE/Certificate.pm
index b8415e2..e74887c 100644
--- a/src/PVE/Certificate.pm
+++ b/src/PVE/Certificate.pm
@@ -1,5 +1,4 @@
package PVE::Certificate;
-
use strict;
use warnings;
@@ -134,26 +133,48 @@ sub strip_leading_text {
return $content;
}
+# Splits the pem chain into entries with their leading text
sub split_pem {
my ($content, %opts) = @_;
- my $label = $opts{label} // 'CERTIFICATE';
- my $header = $header_re->($label);
- return split(/(?=$header)/, $content);
+ my $footer = $footer_re->($opts{label} // 'CERTIFICATE');
+
+ return $content =~ /(.*?$footer)/sg;
}
+# Parses the pem or pem chain for complete validity and returns
+# only the pem/pem chain removing any extra text
sub check_pem {
my ($content, %opts) = @_;
+ my $label = $opts{label} // 'CERTIFICATE';
$content = strip_leading_text($content);
- my $re = $pem_re->($opts{label} // 'CERTIFICATE');
- $re = qr/($re\n+)*$re/ if $opts{multiple};
+ my $result_pem = "";
+ if (delete $opts{multiple}) {
+ my @split = split_pem($content, label => $label);
+
+ if (!@split) {
+ return undef if $opts{noerr};
+ die "pem chain could not be split into separate entries\n";
+ }
+
+ for my $entry (@split) {
+ my $entry_pem = check_pem($entry, %opts);
+
+ return undef if !$entry_pem;
+
+ $result_pem .= $entry_pem;
+ }
+ } else {
+ my $re = $pem_re->($label);
+ $result_pem = $content if $content =~ /^$re$/;
+ }
- return $content if $content =~ /^$re$/; # OK
+ return $result_pem if $result_pem;
return undef if $opts{noerr};
- die "not a valid PEM-formatted string.\n";
+ die "not a valid PEM-formatted string\n";
}
sub pem_to_der {
diff --git a/test/Makefile b/test/Makefile
index 9b9f81b..8b725c5 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -14,6 +14,8 @@ TESTS = lock_file.test \
is_deeply_test.test \
section_config_property_isolation_test.pl \
file-test.pl \
+ check_pem_test.pl \
+ split_pem_test.pl \
all:
diff --git a/test/check_pem_test.pl b/test/check_pem_test.pl
new file mode 100755
index 0000000..f26a38b
--- /dev/null
+++ b/test/check_pem_test.pl
@@ -0,0 +1,357 @@
+#!/usr/bin/perl
+# Tests the PVE::Certificate::check_pem function for
+# correctness and coverage of edgecases.
+use strict;
+use warnings;
+
+use lib '../src';
+
+use Test::More;
+
+use PVE::Certificate;
+
+# Arrange
+my $setup = [
+ {
+ expected_success => 1,
+ name => "full pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+MIIBsjCCAVugAwIBAgIJAO2g8Z0dXk9tMAoGCCqGSM49BAMCMEUxCzAJBgNVBAYT
+AlVTMQswCQYDVQQIDAJDQTEQMA4GA1UEBwwHQmVya2VsZXkxEDAOBgNVBAoMB1Rl
+c3QgQ0EwHhcNMjAwMTAxMDAwMDAwWhcNMzAwMTAxMDAwMDAwWjBFMQswCQYDVQQG
+EwJVUzELMAkGA1UECAwCQ0ExEDAOBgNVBAcMB0JlcmtlbGV5MRAwDgYDVQQKDAdU
+ZXN0IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEv5Q8q1p7qZ2gqkQ0Qn5x
+0n9yqv8n8n7n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8aNT
+MFEwHQYDVR0OBBYEFOu2Y0bq8v3z7qkq1m1Qwqkq1m1QMB8GA1UdIwQYMBaAFOu2
+Y0bq8v3z7qkq1m1Qwqkq1m1QMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwID
+SAAwRQIhANfakefakefakefakefakefakefakefakefake
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ expected_success => 1,
+ name => "other label pem",
+ label => "SOME LABEL",
+ pem => <<'EOF',
+-----BEGIN SOME LABEL-----
+MIIBsjCCAVugAwIBAgIJAO2g8Z0dXk9tMAoGCCqGSM49BAMCMEUxCzAJBgNVBAYT
+AlVTMQswCQYDVQQIDAJDQTEQMA4GA1UEBwwHQmVya2VsZXkxEDAOBgNVBAoMB1Rl
+c3QgQ0EwHhcNMjAwMTAxMDAwMDAwWhcNMzAwMTAxMDAwMDAwWjBFMQswCQYDVQQG
+EwJVUzELMAkGA1UECAwCQ0ExEDAOBgNVBAcMB0JlcmtlbGV5MRAwDgYDVQQKDAdU
+ZXN0IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEv5Q8q1p7qZ2gqkQ0Qn5x
+0n9yqv8n8n7n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8aNT
+MFEwHQYDVR0OBBYEFOu2Y0bq8v3z7qkq1m1Qwqkq1m1QMB8GA1UdIwQYMBaAFOu2
+Y0bq8v3z7qkq1m1Qwqkq1m1QMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwID
+SAAwRQIhANfakefakefakefakefakefakefakefakefake
+-----END SOME LABEL-----
+EOF
+ },
+ {
+ expected_success => 1,
+ name => "simple pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+test
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ expected_success => 1,
+ name => "spaced out pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+
+test
+
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ expected_success => 1,
+ name => "only newline pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ expected_success => 1,
+ name => "many newlines pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+
+
+
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ expected_success => 0,
+ name => "no content pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE----------END CERTIFICATE-----
+EOF
+ },
+ {
+ expected_success => 1,
+ name => "preceding content pem",
+ pem => <<'EOF',
+some extended content
+-----BEGIN CERTIFICATE-----
+test
+-----END CERTIFICATE-----
+EOF
+
+ expected_result => <<'EOF',
+-----BEGIN CERTIFICATE-----
+test
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ expected_success => 0,
+ name => "following content pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+test
+-----END CERTIFICATE-----
+some extended content
+EOF
+ },
+ {
+ expected_success => 0,
+ name => "empty pem",
+ pem => <<'EOF',
+
+EOF
+ },
+ {
+ expected_success => 0,
+ name => "upsidedown pem",
+ pem => <<'EOF',
+-----END CERTIFICATE-----
+test
+-----BEGIN CERTIFICATE-----
+EOF
+ },
+ {
+ expected_success => 1,
+ name => "multi pem",
+ multiple => 1,
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+12JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+22JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+32JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+42JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ expected_success => 0,
+ name => "multiple as single pem",
+ pem => <<'EOF',
+Subject: CN=some.test.content
+Issuer: CN=Org Issuing CA 3
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+Subject: CN=Org Issuing CA 3
+Issuer: CN=Org Root CA
+-----BEGIN CERTIFICATE-----
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ expected_success => 1,
+ name => "big pem different label",
+ multiple => 1,
+ label => "LABEL",
+ pem => <<'EOF',
+Subject: CN=some.test.content
+Issuer: CN=Org Issuing CA 3
+-----BEGIN LABEL-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END LABEL-----
+Subject: CN=Org Issuing CA 3
+Issuer: CN=Org Root CA
+-----BEGIN LABEL-----
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END LABEL-----
+Subject: CN=Org Root CA
+Issuer: CN=Org Root CA
+-----BEGIN LABEL-----
+3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END LABEL-----
+EOF
+
+ expected_result => <<'EOF',
+-----BEGIN LABEL-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END LABEL-----
+-----BEGIN LABEL-----
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END LABEL-----
+-----BEGIN LABEL-----
+3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END LABEL-----
+EOF
+ },
+ {
+ expected_success => 1,
+ name => "other real pem",
+ pem => <<'EOF',
+Subject: CN=Some subject with 2 Points,O=A Organization,L=Some Lation,C=TT
+Issuer: CN=The Orgs Name RootCA 2015,O=The Orgs name Institutions Cert. Authority,L=Location,C=TT
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ expected_result => <<'EOF',
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ expected_success => 0,
+ name => "invalid single pem",
+ pem => <<'EOF',
+Subject: CN=Some subject with 2 Points,O=A Organization,L=Some Lation,C=TT
+Issuer: CN=The Orgs Name RootCA 2015,O=The Orgs name Institutions Cert. Authority,L=Location,C=TT
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdthese !?''*:;$%&/ are not allowedWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ expected_success => 0,
+ name => "invalid multi pem",
+ multiple => 1,
+ pem => <<'EOF',
+Subject: CN=Some subject with 2 Points,O=A Organization,L=Some Lation,C=TT
+Issuer: CN=The Orgs Name RootCA 2015,O=The Orgs name Institutions Cert. Authority,L=Location,C=TT
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdthese !?''*:;$%&/ are not allowedWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+Subject: CN=Some subject with 2 Points,O=A Organization,L=Some Lation,C=TT
+Issuer: CN=The Orgs Name RootCA 2015,O=The Orgs name Institutions Cert. Authority,L=Location,C=TT
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+
+EOF
+ },
+ {
+ expected_success => 1,
+ name => "single as multiple pem",
+ multiple => 1,
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdtheseZ2RmaXVwYWJ2aXV1YXdlYmxmamlraWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ expected_success => 1,
+ name => "single as multiple pem",
+ multiple => 1,
+ pem => <<'EOF',
+Subject: CN=Some subject with 2 Points,O=A Organization,L=Some Lation,C=TT
+Issuer: CN=The Orgs Name RootCA 2015,O=The Orgs name Institutions Cert. Authority,L=Location,C=TT
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdtheseZ2RmaXVwYWJ2aXV1YXdlYmxmamlraWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ expected_result => <<'EOF',
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdtheseZ2RmaXVwYWJ2aXV1YXdlYmxmamlraWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ },
+];
+
+for my $data ($setup->@*) {
+ subtest $data->{name} => sub {
+ # Act
+ my $check_result = PVE::Certificate::check_pem(
+ $data->{pem},
+ noerr => 1,
+ multiple => $data->{multiple},
+ label => $data->{label},
+ );
+
+ # Assert
+ if ($data->{expected_success}) {
+ ok($check_result, "is successful");
+
+ my $expected_result =
+ $data->{expected_result}
+ ? $data->{expected_result}
+ : $data->{pem};
+ is(
+ $check_result, $expected_result, "has correct result content",
+ );
+ } else {
+ is($check_result, undef, "has correctly returned undef");
+ }
+ }
+}
+
+done_testing();
diff --git a/test/split_pem_test.pl b/test/split_pem_test.pl
new file mode 100755
index 0000000..4239e5c
--- /dev/null
+++ b/test/split_pem_test.pl
@@ -0,0 +1,279 @@
+#!/usr/bin/perl
+# Tests the PVE::Certificate::split_pem function for
+# correctness and coverage of edgecases.
+use strict;
+use warnings;
+
+use lib '../src';
+
+use Test::More;
+
+use PVE::Certificate;
+
+# Arrange
+my $setup = [
+ {
+ expected_success => 1,
+ name => "single pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+MIIBsjCCAVugAwIBAgIJAO2g8Z0dXk9tMAoGCCqGSM49BAMCMEUxCzAJBgNVBAYT
+AlVTMQswCQYDVQQIDAJDQTEQMA4GA1UEBwwHQmVya2VsZXkxEDAOBgNVBAoMB1Rl
+c3QgQ0EwHhcNMjAwMTAxMDAwMDAwWhcNMzAwMTAxMDAwMDAwWjBFMQswCQYDVQQG
+EwJVUzELMAkGA1UECAwCQ0ExEDAOBgNVBAcMB0JlcmtlbGV5MRAwDgYDVQQKDAdU
+ZXN0IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEv5Q8q1p7qZ2gqkQ0Qn5x
+0n9yqv8n8n7n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8aNT
+MFEwHQYDVR0OBBYEFOu2Y0bq8v3z7qkq1m1Qwqkq1m1QMB8GA1UdIwQYMBaAFOu2
+Y0bq8v3z7qkq1m1Qwqkq1m1QMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwID
+SAAwRQIhANfakefakefakefakefakefakefakefakefake
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ expected_success => 1,
+ name => "no extra text pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+12JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+22JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+32JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+42JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+
+ expected_result => [
+ <<'EOF',
+-----BEGIN CERTIFICATE-----
+12JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+
+ <<'EOF',
+-----BEGIN CERTIFICATE-----
+22JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+
+ <<'EOF',
+-----BEGIN CERTIFICATE-----
+32JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+
+ <<'EOF',
+-----BEGIN CERTIFICATE-----
+42JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ ],
+ },
+ {
+ expected_success => 1,
+ name => "leading and interleaved text pem",
+ pem => <<'EOF',
+Subject: CN=some.test.content
+Issuer: CN=Org Issuing CA 3
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+Subject: CN=Org Issuing CA 3
+Issuer: CN=Org Root CA
+-----BEGIN CERTIFICATE-----
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+Subject: CN=Org Root CA
+Issuer: CN=Org Root CA
+-----BEGIN CERTIFICATE-----
+3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+
+ expected_result => [
+ <<'EOF',
+Subject: CN=some.test.content
+Issuer: CN=Org Issuing CA 3
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+
+ <<'EOF',
+Subject: CN=Org Issuing CA 3
+Issuer: CN=Org Root CA
+-----BEGIN CERTIFICATE-----
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+
+ <<'EOF',
+Subject: CN=Org Root CA
+Issuer: CN=Org Root CA
+-----BEGIN CERTIFICATE-----
+3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ ],
+ },
+ {
+ expected_success => 1,
+ name => "massive glob pem",
+ pem => <<'EOF',
+Subject: CN=some.test.content
+Issuer: CN=Org Issuing CA 3
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+Subject: CN=Org Issuing CA 3
+Issuer: CN=Org Root CA
+-----BEGIN CERTIFICATE-----
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+Subject: CN=Org Root CA
+Issuer: CN=Org Root CA
+-----BEGIN CERTIFICATE-----
+3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ expected_success => 1,
+ name => "no beginning pem",
+ pem => <<'EOF',
+Subject: CN=some.test.content
+Issuer: CN=Org Issuing CA 3
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+Subject: CN=Org Root CA
+Issuer: CN=Org Root CA
+3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+
+ expected_result => [
+ <<'EOF',
+Subject: CN=some.test.content
+Issuer: CN=Org Issuing CA 3
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+
+ <<'EOF',
+Subject: CN=Org Root CA
+Issuer: CN=Org Root CA
+3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ ],
+
+ },
+ {
+ expected_success => 0,
+ name => "not a pem pem",
+ pem => <<'EOF',
+Subject: CN=some.test.content
+Issuer: CN=Org Issuing CA 3
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+Subject: CN=Org Issuing CA 3
+Issuer: CN=Org Root CA
+EOF
+ },
+ {
+ expected_success => 1,
+ name => "following text pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+32JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+42JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+some more text that we would like to remove
+EOF
+
+ expected_result => [
+ <<'EOF',
+-----BEGIN CERTIFICATE-----
+32JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+
+ <<'EOF',
+-----BEGIN CERTIFICATE-----
+42JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ ],
+ },
+];
+
+for my $data ($setup->@*) {
+ subtest $data->{name} => sub {
+ # Act
+ my @split_result = PVE::Certificate::split_pem(
+ $data->{pem}, label => $data->{label},
+ );
+
+ # Assert
+ if ($data->{expected_success}) {
+ ok(@split_result, "is successful");
+ my $expected_result =
+ $data->{expected_result}
+ ? $data->{expected_result}
+ : [$data->{pem}];
+
+ is_deeply(
+ \@split_result, \@$expected_result, "has correct split output",
+ );
+ } else {
+ is_deeply(\@split_result, [], "has correctly returned empty");
+ }
+ }
+}
+
+done_testing();
--
2.47.3
^ permalink raw reply related [relevance 2%]
* [PATCH proxmox-acme v3 2/2] fix #5978: pem parser: relax parsing of chain entries:
2026-07-03 10:51 13% [PATCH common/proxmox-acme v3 " Thomas Ellmenreich
2026-07-03 10:51 2% ` [PATCH common v3 1/2] " Thomas Ellmenreich
@ 2026-07-03 10:51 5% ` Thomas Ellmenreich
1 sibling, 0 replies; 19+ results
From: Thomas Ellmenreich @ 2026-07-03 10:51 UTC (permalink / raw)
To: pve-devel; +Cc: Thomas Ellmenreich
Instead of using a custom regex to parse pem chains, now uses
the pve-common Certificate::check_pem function to do so. This
now allows for additional text and whitespace inbetween the
chain entries.
Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
---
src/PVE/ACME.pm | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
index e6fb9c2..7adda25 100644
--- a/src/PVE/ACME.pm
+++ b/src/PVE/ACME.pm
@@ -526,14 +526,15 @@ sub get_certificate {
}
}
}
- die "no matching alternate chain for '$root' returned by server\n"
+ die "no matching alternate chain for '$root' provided by the acme server\n"
if !defined($res);
}
- if ($res =~ /^(-----BEGIN CERTIFICATE-----)(.+)(-----END CERTIFICATE-----)$/s) { # untaint
- return $1 . $2 . $3;
- }
- die "Server reply does not look like a PEM encoded certificate\n";
+ my $parsed = eval { PVE::Certificate::check_pem($res, multiple => 1) };
+ die
+ "value returned by acme certificate url does not look like a PEM encoded certificate: $@\n"
+ if $@;
+ return $parsed;
};
$self->fatal("POST of '$order->{certificate}' failed - $@", $r) if $@;
return $return;
--
2.47.3
^ permalink raw reply related [relevance 5%]
* [PATCH common/proxmox-acme v3 0/2] fix #5978: pem parser: relax parsing of chain entries
@ 2026-07-03 10:51 13% Thomas Ellmenreich
2026-07-03 10:51 2% ` [PATCH common v3 1/2] " Thomas Ellmenreich
2026-07-03 10:51 5% ` [PATCH proxmox-acme v3 2/2] fix #5978: pem parser: relax parsing of chain entries: Thomas Ellmenreich
0 siblings, 2 replies; 19+ results
From: Thomas Ellmenreich @ 2026-07-03 10:51 UTC (permalink / raw)
To: pve-devel; +Cc: Thomas Ellmenreich
According to RFC 8555, expected certchains should come
without whitespace or explanatory texts inbetween chain
entries. These two patches relax our parser to also
accept text or whitespaces inbetween chain entries.
To make sure that the acme changes work as expected I
setup the pebble acme server [1] locally, and worked
through the acme flow to get a new certificate. I then
manually modified the final certificate to contain
descriptive text which worked without issues.
changes since v2:
- cleaner implementation and correction of mistakes in
check_pem in pve-common
- get_certificate in proxmox-acme now correctly calls
check_pem with the 'multiple' option enabled
- removed ambiguity in the error messages of
get_certificate
- correction of tests, to better compare returned value
to expected value
- performed proper end-to-end test with pebble [1]
- proper formatting (hopefully)
changes since v1:
- Where in v1 check_pem was just a wrapper of split_pem,
they now perform different functions
- split_pem now purely splits the PEM chain into separate
entries and does no further validation. Returning each
entry with its leading text.
- check_pem retains the original functionality, except
when the multiple option is active, in which case it
uses split_pem to get single entries and then calls
itself recursively
- On the ACME side, errors are now captured, wrapped,
and then rethrown.
[1] https://github.com/letsencrypt/pebble
pve-common:
Thomas Ellmenreich (1):
fix #5978: pem parser: relax parsing of chain entries
src/PVE/Certificate.pm | 37 ++++-
test/Makefile | 2 +
test/check_pem_test.pl | 357 +++++++++++++++++++++++++++++++++++++++++
test/split_pem_test.pl | 279 ++++++++++++++++++++++++++++++++
4 files changed, 667 insertions(+), 8 deletions(-)
create mode 100755 test/check_pem_test.pl
create mode 100755 test/split_pem_test.pl
proxmox-acme:
Thomas Ellmenreich (1):
fix #5978: pem parser: relax parsing of chain entries:
src/PVE/ACME.pm | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
Summary over all repositories:
5 files changed, 673 insertions(+), 13 deletions(-)
--
Generated by murpp 0.12.0
^ permalink raw reply [relevance 13%]
* Re: [PATCH proxmox-acme v2 2/2] fix #5978: pem parser: relax parsing of chain entries:
2026-06-17 12:42 5% ` [PATCH proxmox-acme v2 2/2] " Thomas Ellmenreich
2026-06-24 10:57 5% ` Fabian Grünbichler
@ 2026-06-24 11:38 5% ` Thomas Lamprecht
1 sibling, 0 replies; 19+ results
From: Thomas Lamprecht @ 2026-06-24 11:38 UTC (permalink / raw)
To: Thomas Ellmenreich, pve-devel
Am 17.06.26 um 14:42 schrieb Thomas Ellmenreich:
> Instead of using a custom regex to parse pem chains, now uses
> the pve-common Certificate::check_pem function to do so. This
> now allows for additional text and whitespace inbetween the
> chain entries.
>
> Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
> ---
> src/PVE/ACME.pm | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
> index e6fb9c2..4b06817 100644
> --- a/src/PVE/ACME.pm
> +++ b/src/PVE/ACME.pm
> @@ -530,10 +530,10 @@ sub get_certificate {
> if !defined($res);
> }
>
> - if ($res =~ /^(-----BEGIN CERTIFICATE-----)(.+)(-----END CERTIFICATE-----)$/s) { # untaint
> - return $1 . $2 . $3;
> - }
> - die "Server reply does not look like a PEM encoded certificate\n";
> + my $parsed = eval { PVE::Certificate::check_pem->($res) };
Why the -> ? That's normally how one calls code references or blessed objects,
but not "normal" methods. As above will call check_perm without arguments and
then try to call the result as code reference with $res as parameter, so this
will always fail FWICT. Was this actually tested end to end?
Also, this fails with certs that are full chains, so this probably should be:
my $parsed = eval { PVE::Certificate::check_pem($res, multiple => 1) };
> + die "Server reply does not look like a PEM encoded certificate: $@\n"
Nit: server is not really _that_ telling here, could be also interpreted as some
API server part of ours (and yes, that wording is somewhat pre-existing in another
error in this method, but still).
> + if $@;
> + return $parsed;
> };
> $self->fatal("POST of '$order->{certificate}' failed - $@", $r) if $@;
> return $return;
^ permalink raw reply [relevance 5%]
* Re: [PATCH proxmox-acme v2 2/2] fix #5978: pem parser: relax parsing of chain entries:
2026-06-17 12:42 5% ` [PATCH proxmox-acme v2 2/2] " Thomas Ellmenreich
@ 2026-06-24 10:57 5% ` Fabian Grünbichler
2026-06-24 11:38 5% ` Thomas Lamprecht
1 sibling, 0 replies; 19+ results
From: Fabian Grünbichler @ 2026-06-24 10:57 UTC (permalink / raw)
To: pve-devel, Thomas Ellmenreich
Reviewed-by: Fabian Grünbichler
(once patch #1 has the feedback adressed)
On June 17, 2026 2:42 pm, Thomas Ellmenreich wrote:
> Instead of using a custom regex to parse pem chains, now uses
> the pve-common Certificate::check_pem function to do so. This
> now allows for additional text and whitespace inbetween the
> chain entries.
>
> Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
> ---
> src/PVE/ACME.pm | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
> index e6fb9c2..4b06817 100644
> --- a/src/PVE/ACME.pm
> +++ b/src/PVE/ACME.pm
> @@ -530,10 +530,10 @@ sub get_certificate {
> if !defined($res);
> }
>
> - if ($res =~ /^(-----BEGIN CERTIFICATE-----)(.+)(-----END CERTIFICATE-----)$/s) { # untaint
> - return $1 . $2 . $3;
> - }
> - die "Server reply does not look like a PEM encoded certificate\n";
> + my $parsed = eval { PVE::Certificate::check_pem->($res) };
> + die "Server reply does not look like a PEM encoded certificate: $@\n"
> + if $@;
> + return $parsed;
> };
> $self->fatal("POST of '$order->{certificate}' failed - $@", $r) if $@;
> return $return;
> --
> 2.47.3
>
>
>
>
>
>
^ permalink raw reply [relevance 5%]
* Re: [PATCH common v2 1/2] fix #5978: pem parser: relax parsing of chain entries:
2026-06-17 12:42 2% ` [PATCH common v2 1/2] fix #5978: pem parser: relax parsing of chain entries: Thomas Ellmenreich
2026-06-24 9:27 5% ` Thomas Lamprecht
@ 2026-06-24 10:57 4% ` Fabian Grünbichler
1 sibling, 0 replies; 19+ results
From: Fabian Grünbichler @ 2026-06-24 10:57 UTC (permalink / raw)
To: pve-devel, Thomas Ellmenreich
a few more comments below, but this is already shaping up nicely!
On June 17, 2026 2:42 pm, Thomas Ellmenreich wrote:
> Relaxes the parser to allow for text and whitespaces inbetween certchain
> entries. The splitting of PEM chains was also reworked to split each entry at
> its end, grouping it with its leading text.
>
> Added testsuite to cover a bunch of parsing edge cases.
>
> Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
> ---
> src/PVE/Certificate.pm | 25 +++-
> test/Makefile | 2 +
> test/check_pem_test.pl | 332 +++++++++++++++++++++++++++++++++++++++++
> test/split_pem_test.pl | 272 +++++++++++++++++++++++++++++++++
> 4 files changed, 625 insertions(+), 6 deletions(-)
> create mode 100755 test/check_pem_test.pl
> create mode 100755 test/split_pem_test.pl
>
> diff --git a/src/PVE/Certificate.pm b/src/PVE/Certificate.pm
> index b8415e2..387405b 100644
> --- a/src/PVE/Certificate.pm
> +++ b/src/PVE/Certificate.pm
> @@ -134,23 +134,36 @@ sub strip_leading_text {
> return $content;
> }
>
> +# Splits the pem chain into entries with their leading text
> sub split_pem {
> my ($content, %opts) = @_;
> - my $label = $opts{label} // 'CERTIFICATE';
>
> - my $header = $header_re->($label);
> - return split(/(?=$header)/, $content);
> + my $footer = $footer_re->($opts{label} // 'CERTIFICATE');
> +
nit: trailing whitespace here (the blank line is not actually empty)
there's a few occurences of this below as well, I can really recommend
making your editor and/or git flag those ;) sometimes trailing
whitespace (e.g. in test data) can be okay, but usually it's a sign
something is off formatting-wise.
> + return $content =~ /(.*?$footer)/sg;
> }
>
> +# Parses the pem or pem chain for complete validity and returns
> +# only the pem/pem chain removing any extra text
> sub check_pem {
> my ($content, %opts) = @_;
>
> + my $label = $opts{label} // 'CERTIFICATE';
> $content = strip_leading_text($content);
>
> - my $re = $pem_re->($opts{label} // 'CERTIFICATE');
> - $re = qr/($re\n+)*$re/ if $opts{multiple};
> + my $result_pem = undef;
just
my $result_pem;
is enough, variables start out undefined.
> + if($opts{multiple}) {
nit: missing space after "if"
> + my @split = split_pem($content, label=>$label);
you probably want to check for an empty list here and die with and
error/return undef depending on whether noerr is set
> +
> + $result_pem = eval {
> + join("", map { check_pem($_, label=>$label ) } @split)
> + };
you can move the $result_pem inside the eval, makes for easier reading
IMHO, but you don't even need that.
if you pass all the options (except multiple) to the recursive call,
then check_pem will
- die if noerr is not set, which is okay (no need for eval to catch it)
- return undef if noerr is set, which you can then handle here
this probably means it's more readable to not use map, but use a proper
loop instead.
> + } else {
> + my $re = $pem_re->($label);
> + $result_pem = $content if $content =~ /^$re$/;
> + }
>
> - return $content if $content =~ /^$re$/; # OK
> + return $result_pem if defined($result_pem);
>
> return undef if $opts{noerr};
> die "not a valid PEM-formatted string.\n";
> diff --git a/test/Makefile b/test/Makefile
> index 9b9f81b..8b725c5 100644
> --- a/test/Makefile
> +++ b/test/Makefile
> @@ -14,6 +14,8 @@ TESTS = lock_file.test \
> is_deeply_test.test \
> section_config_property_isolation_test.pl \
> file-test.pl \
> + check_pem_test.pl \
> + split_pem_test.pl \
>
> all:
>
> diff --git a/test/check_pem_test.pl b/test/check_pem_test.pl
> new file mode 100755
> index 0000000..10ef295
> --- /dev/null
> +++ b/test/check_pem_test.pl
> @@ -0,0 +1,332 @@
> +#!/usr/bin/perl
> +# Tests the PVE::Certificate::check_pem function for
> +# correctness and coverage of edgecases.
> +
> +use lib '../src';
> +
> +use Test::More;
> +
> +use PVE::Certificate;
> +
> +# Arrange
> +my $setup = [
> [..]
> + {
> + successful => 1,
I'd call this `expected_success` or `expect_success`, to make it easy to
understand even at a glance. successful could also be referring to the
actual result, not the expectation.
> + name => "single as multiple pem",
> + multiple => 1,
> + pem => <<'EOF',
> +-----BEGIN CERTIFICATE-----
> +1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
> +dmFpdXdlYmdtheseZ2RmaXVwYWJ2aXV1YXdlYmxmamlraWprZmdyYXNkaHJmaW9h
> +dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
> +c2JlZ2tseTxzZWl2IGF3ZWlidm4=
> +-----END CERTIFICATE-----
we could probably also add a case here for single PEM with comment and
multiple=>1, for completeness' sake
thanks for adding test cases!
> +EOF
> + }
> +];
> +
> +for my $data ($setup->@*) {
you could treat each iteration here as a subtest
> + # Act
> + my $check_result = PVE::Certificate::check_pem(
> + $data->{pem},
> + noerr => 1,
> + multiple => $data->{multiple},
> + label => $data->{label},
> + );
> +
> + # Assert
> + if ($data->{successful}) {
> + ok($check_result, $data->{name} . " is successful");
> + } else {
> + ok(!$check_result, $data->{name} . " correctly rejected");
> + }
> +
> + my $expected_result = $data->{expected_result}
> + ? $data->{expected_result}
> + : $data->{pem};
> +
> + if ($data->{successful}) {
> + ok($check_result eq $expected_result, $data->{name} . " has correct check output");
if you use `is` here, you get nice output in case of a mismatch
> + } else {
> + ok(!defined($check_result), $data->{name} . " has correct check output");
this one here and the else branch above test the same thing, except that
the first variant above is slightly too coarse. I'd move the defined up,
and drop the else branch here. and then the whole test could be
restructured:
if ($successful) {
1. check return value is defined
2. construct expected_result
3. check result is expected_result
} else {
1. check return value is undef
}
> + }
> +}
> +
> +done_testing();
> diff --git a/test/split_pem_test.pl b/test/split_pem_test.pl
> new file mode 100755
> index 0000000..f7f7bc0
> --- /dev/null
> +++ b/test/split_pem_test.pl
> @@ -0,0 +1,272 @@
> +#!/usr/bin/perl
> +# Tests the PVE::Certificate::split_pem function for
> +# correctness and coverage of edgecases.
> +
> +use lib '../src';
> +
> +use Test::More;
> +
> +use PVE::Certificate;
> +
> +# Arrange
> +my $setup = [
> [..]
> +];
> +
> +for my $data ($setup->@*) {
same here as above
> + # Act
> + my @split_result = PVE::Certificate::split_pem(
> + $data->{pem},
> + label => $data->{label}
> + );
> +
> + # Assert
> + if ($data->{successful}) {
> + ok(@split_result, $data->{name} . " is successful");
> + } else {
> + ok(!@split_result, $data->{name} . " correctly rejected");
nit: trailing whitespace here as well
I think here it would make sense to explicitly check for empty lists
being returned, that would also allow us to drop the else branch below
same as for the check_pem test.
> + }
> +
> + my $expected_result = $data->{expected_result}
> + ? $data->{expected_result}
> + : [ $data->{pem} ];
> +
> + if ($data->{successful}) {
> + ok(@split_result eq @$expected_result, $data->{name} . " has correct check output");
> + } else {
> + ok(!@split_result eq @$expected_result, $data->{name} . " has correct check output");
> + }
the checks here are wrong:
1. the inversion of `eq` is `ne` ;)
perl is tricky/special here as well - you have `==` and `!=` which
compare "numerically", and `eq` and `ne` which compare "stringwise".
because of coercion happening behind your back there can be all sorts of
funny side-effects, sometimes practical, sometimes confusing.
e.g., comparing
$a = 5;
with `eq "5"` is true, as is `== 5`.
but comparing
$a = "5foo"
with `eq "5"` is obviously false, while `== 5` will print a warning *and
evaluate to true*
similarly, empty lists , arrays and hashes vs. definedness checks vs.
explicit scalar conversions can be tricky. when in doubt, be explicit,
and add a call to `scalar(..)` or `defined(..)` instead of relying on
easy-to-get-wrong semantics/side-effects.
2. you cannot use `eq` to compare arrays like you want here
but - Test::More comes with `is_deeply`, which has the added benefit of
giving nice output in case of broken tests, e.g.:
not ok 6 - leading and interleaved text pem has correct check output
# Failed test 'leading and interleaved text pem has correct check output'
# at ./split_pem_test.pl line 267.
# Structures begin differing at:
# $got->[0] = 'Subject: CN=some.test.content
# Issuer: CN=Org Issuing CA 3
# -----BEGIN CERTIFICATE-----
# 1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
# dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
# dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
# c2JlZ2tseTxzZWl2IGF3ZWlidm4=
# -----END CERTIFICATE-----
# '
# $expected->[0] = '-----BEGIN CERTIFICATE-----
# 1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
# dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
# dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
# c2JlZ2tseTxzZWl2IGF3ZWlidm4=
# -----END CERTIFICATE-----
# '
> +}
> +
> +done_testing();
> --
> 2.47.3
>
>
>
>
>
>
^ permalink raw reply [relevance 4%]
* Re: [PATCH common v2 1/2] fix #5978: pem parser: relax parsing of chain entries:
2026-06-17 12:42 2% ` [PATCH common v2 1/2] fix #5978: pem parser: relax parsing of chain entries: Thomas Ellmenreich
@ 2026-06-24 9:27 5% ` Thomas Lamprecht
2026-06-24 10:57 4% ` Fabian Grünbichler
1 sibling, 0 replies; 19+ results
From: Thomas Lamprecht @ 2026-06-24 9:27 UTC (permalink / raw)
To: Thomas Ellmenreich, pve-devel
Am 17.06.26 um 14:43 schrieb Thomas Ellmenreich:
> Relaxes the parser to allow for text and whitespaces inbetween certchain
> entries. The splitting of PEM chains was also reworked to split each entry at
> its end, grouping it with its leading text.
>
> Added testsuite to cover a bunch of parsing edge cases.
>
> Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
> ---
> src/PVE/Certificate.pm | 25 +++-
> test/Makefile | 2 +
> test/check_pem_test.pl | 332 +++++++++++++++++++++++++++++++++++++++++
> test/split_pem_test.pl | 272 +++++++++++++++++++++++++++++++++
> 4 files changed, 625 insertions(+), 6 deletions(-)
> create mode 100755 test/check_pem_test.pl
> create mode 100755 test/split_pem_test.pl
>
Noticed a few whitespace errors and formatting issues on applying.
Please ensure code is nicely formatted, for perl we use proxmox-perltidy, which
is a wrapper around upstream perltidy with a locked in configuration that matches
our style guide as closely as possible. Most repos provide a top level "tidy"
make target to simplify running this.
^ permalink raw reply [relevance 5%]
* Re: [PATCH common/proxmox-acme v2 0/2] fix #5978: pem parser: relax parsing of chain entries
2026-06-17 13:21 5% ` [PATCH common/proxmox-acme v2 0/2] fix #5978: pem parser: relax parsing of chain entries Shannon Sterz
@ 2026-06-18 8:46 5% ` Thomas Ellmenreich
0 siblings, 0 replies; 19+ results
From: Thomas Ellmenreich @ 2026-06-18 8:46 UTC (permalink / raw)
To: Shannon Sterz, pve-devel
Good point, thanks!
Changes since v1:
- Where in v1 check_pem was just a wrapper of split_pem, they now perform
different functions
- split_pem now purely splits the PEM chain into separate entries and does no
further validation. Returning each entry with its leading text.
- check_pem retains the original functionality, except when the multiple option
is active, in which case it uses split_pem to get single entries and then
calls itself recursively
- On the ACME side, errors are now captured, wrapped, and then rethrown.
^ permalink raw reply [relevance 5%]
* Re: [PATCH common/proxmox-acme v2 0/2] fix #5978: pem parser: relax parsing of chain entries
2026-06-17 12:42 14% [PATCH common/proxmox-acme v2 " Thomas Ellmenreich
2026-06-17 12:42 2% ` [PATCH common v2 1/2] fix #5978: pem parser: relax parsing of chain entries: Thomas Ellmenreich
2026-06-17 12:42 5% ` [PATCH proxmox-acme v2 2/2] " Thomas Ellmenreich
@ 2026-06-17 13:21 5% ` Shannon Sterz
2026-06-18 8:46 5% ` Thomas Ellmenreich
2026-07-03 10:57 5% ` superseded: " Thomas Ellmenreich
3 siblings, 1 reply; 19+ results
From: Shannon Sterz @ 2026-06-17 13:21 UTC (permalink / raw)
To: Thomas Ellmenreich, pve-devel
On Wed Jun 17, 2026 at 2:42 PM CEST, Thomas Ellmenreich wrote:
> According to RFC 8555, expected certchains should come
> without whitespace or explanatory texts inbetween chain
> entries. These two patches relax our parser to also
> accept text or whitespaces inbetween chain entries.
just a small note: usually when sending a v2 (or any version > 1) it's
encouraged to include a lit of changes since the last version. see for
example the cover letter of Lukas' recent series [1].
[1]: https://lore.proxmox.com/pdm-devel/20260615125823.193288-1-l.wagner@proxmox.com/T/#m6a7b03e2c9c612b69f49541deadda2f3bd412492
>
> pve-common:
>
> Thomas Ellmenreich (1):
> fix #5978: pem parser: relax parsing of chain entries:
>
> src/PVE/Certificate.pm | 25 +++-
> test/Makefile | 2 +
> test/check_pem_test.pl | 332 +++++++++++++++++++++++++++++++++++++++++
> test/split_pem_test.pl | 272 +++++++++++++++++++++++++++++++++
> 4 files changed, 625 insertions(+), 6 deletions(-)
> create mode 100755 test/check_pem_test.pl
> create mode 100755 test/split_pem_test.pl
>
>
> proxmox-acme:
>
> Thomas Ellmenreich (1):
> fix #5978: pem parser: relax parsing of chain entries:
>
> src/PVE/ACME.pm | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
>
> Summary over all repositories:
> 5 files changed, 629 insertions(+), 10 deletions(-)
^ permalink raw reply [relevance 5%]
* superseded: [PATCH common/proxmox-acme 0/2] fix #5978: pem parser: relax parsing of chain entries
2026-06-09 13:15 14% [PATCH common/proxmox-acme 0/2] fix #5978: pem parser: relax parsing of chain entries Thomas Ellmenreich
2026-06-09 13:15 4% ` [PATCH common 1/2] fix #5978: pem parser: relax parsing of chain entries: Thomas Ellmenreich
2026-06-09 13:15 5% ` [PATCH proxmox-acme 2/2] " Thomas Ellmenreich
@ 2026-06-17 12:55 5% ` Thomas Ellmenreich
2 siblings, 0 replies; 19+ results
From: Thomas Ellmenreich @ 2026-06-17 12:55 UTC (permalink / raw)
To: Thomas Ellmenreich, pve-devel
superseded-by v2:
https://lore.proxmox.com/pve-devel/20260609131549.104216-1-t.ellmenreich@proxmox.com/
^ permalink raw reply [relevance 5%]
* [PATCH common v2 1/2] fix #5978: pem parser: relax parsing of chain entries:
2026-06-17 12:42 14% [PATCH common/proxmox-acme v2 " Thomas Ellmenreich
@ 2026-06-17 12:42 2% ` Thomas Ellmenreich
2026-06-24 9:27 5% ` Thomas Lamprecht
2026-06-24 10:57 4% ` Fabian Grünbichler
2026-06-17 12:42 5% ` [PATCH proxmox-acme v2 2/2] " Thomas Ellmenreich
` (2 subsequent siblings)
3 siblings, 2 replies; 19+ results
From: Thomas Ellmenreich @ 2026-06-17 12:42 UTC (permalink / raw)
To: pve-devel; +Cc: Thomas Ellmenreich
Relaxes the parser to allow for text and whitespaces inbetween certchain
entries. The splitting of PEM chains was also reworked to split each entry at
its end, grouping it with its leading text.
Added testsuite to cover a bunch of parsing edge cases.
Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
---
src/PVE/Certificate.pm | 25 +++-
test/Makefile | 2 +
test/check_pem_test.pl | 332 +++++++++++++++++++++++++++++++++++++++++
test/split_pem_test.pl | 272 +++++++++++++++++++++++++++++++++
4 files changed, 625 insertions(+), 6 deletions(-)
create mode 100755 test/check_pem_test.pl
create mode 100755 test/split_pem_test.pl
diff --git a/src/PVE/Certificate.pm b/src/PVE/Certificate.pm
index b8415e2..387405b 100644
--- a/src/PVE/Certificate.pm
+++ b/src/PVE/Certificate.pm
@@ -134,23 +134,36 @@ sub strip_leading_text {
return $content;
}
+# Splits the pem chain into entries with their leading text
sub split_pem {
my ($content, %opts) = @_;
- my $label = $opts{label} // 'CERTIFICATE';
- my $header = $header_re->($label);
- return split(/(?=$header)/, $content);
+ my $footer = $footer_re->($opts{label} // 'CERTIFICATE');
+
+ return $content =~ /(.*?$footer)/sg;
}
+# Parses the pem or pem chain for complete validity and returns
+# only the pem/pem chain removing any extra text
sub check_pem {
my ($content, %opts) = @_;
+ my $label = $opts{label} // 'CERTIFICATE';
$content = strip_leading_text($content);
- my $re = $pem_re->($opts{label} // 'CERTIFICATE');
- $re = qr/($re\n+)*$re/ if $opts{multiple};
+ my $result_pem = undef;
+ if($opts{multiple}) {
+ my @split = split_pem($content, label=>$label);
+
+ $result_pem = eval {
+ join("", map { check_pem($_, label=>$label ) } @split)
+ };
+ } else {
+ my $re = $pem_re->($label);
+ $result_pem = $content if $content =~ /^$re$/;
+ }
- return $content if $content =~ /^$re$/; # OK
+ return $result_pem if defined($result_pem);
return undef if $opts{noerr};
die "not a valid PEM-formatted string.\n";
diff --git a/test/Makefile b/test/Makefile
index 9b9f81b..8b725c5 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -14,6 +14,8 @@ TESTS = lock_file.test \
is_deeply_test.test \
section_config_property_isolation_test.pl \
file-test.pl \
+ check_pem_test.pl \
+ split_pem_test.pl \
all:
diff --git a/test/check_pem_test.pl b/test/check_pem_test.pl
new file mode 100755
index 0000000..10ef295
--- /dev/null
+++ b/test/check_pem_test.pl
@@ -0,0 +1,332 @@
+#!/usr/bin/perl
+# Tests the PVE::Certificate::check_pem function for
+# correctness and coverage of edgecases.
+
+use lib '../src';
+
+use Test::More;
+
+use PVE::Certificate;
+
+# Arrange
+my $setup = [
+ {
+ successful => 1,
+ name => "full pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+MIIBsjCCAVugAwIBAgIJAO2g8Z0dXk9tMAoGCCqGSM49BAMCMEUxCzAJBgNVBAYT
+AlVTMQswCQYDVQQIDAJDQTEQMA4GA1UEBwwHQmVya2VsZXkxEDAOBgNVBAoMB1Rl
+c3QgQ0EwHhcNMjAwMTAxMDAwMDAwWhcNMzAwMTAxMDAwMDAwWjBFMQswCQYDVQQG
+EwJVUzELMAkGA1UECAwCQ0ExEDAOBgNVBAcMB0JlcmtlbGV5MRAwDgYDVQQKDAdU
+ZXN0IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEv5Q8q1p7qZ2gqkQ0Qn5x
+0n9yqv8n8n7n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8aNT
+MFEwHQYDVR0OBBYEFOu2Y0bq8v3z7qkq1m1Qwqkq1m1QMB8GA1UdIwQYMBaAFOu2
+Y0bq8v3z7qkq1m1Qwqkq1m1QMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwID
+SAAwRQIhANfakefakefakefakefakefakefakefakefake
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "other label pem",
+ label => "SOME LABEL",
+ pem => <<'EOF',
+-----BEGIN SOME LABEL-----
+MIIBsjCCAVugAwIBAgIJAO2g8Z0dXk9tMAoGCCqGSM49BAMCMEUxCzAJBgNVBAYT
+AlVTMQswCQYDVQQIDAJDQTEQMA4GA1UEBwwHQmVya2VsZXkxEDAOBgNVBAoMB1Rl
+c3QgQ0EwHhcNMjAwMTAxMDAwMDAwWhcNMzAwMTAxMDAwMDAwWjBFMQswCQYDVQQG
+EwJVUzELMAkGA1UECAwCQ0ExEDAOBgNVBAcMB0JlcmtlbGV5MRAwDgYDVQQKDAdU
+ZXN0IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEv5Q8q1p7qZ2gqkQ0Qn5x
+0n9yqv8n8n7n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8aNT
+MFEwHQYDVR0OBBYEFOu2Y0bq8v3z7qkq1m1Qwqkq1m1QMB8GA1UdIwQYMBaAFOu2
+Y0bq8v3z7qkq1m1Qwqkq1m1QMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwID
+SAAwRQIhANfakefakefakefakefakefakefakefakefake
+-----END SOME LABEL-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "simple pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+test
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "spaced out pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+
+test
+
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "only newline pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "many newlines pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+
+
+
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 0,
+ name => "no content pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE----------END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "preceding content pem",
+ pem => <<'EOF',
+some extended content
+-----BEGIN CERTIFICATE-----
+test
+-----END CERTIFICATE-----
+EOF
+,
+ expected_result => << 'EOF',
+-----BEGIN CERTIFICATE-----
+test
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 0,
+ name => "following content pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+test
+-----END CERTIFICATE-----
+some extended content
+EOF
+ },
+ {
+ successful => 0,
+ name => "empty pem",
+ pem => <<'EOF',
+
+EOF
+ },
+ {
+ successful => 0,
+ name => "upsidedown pem",
+ pem => <<'EOF',
+-----END CERTIFICATE-----
+test
+-----BEGIN CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "multi pem",
+ multiple => 1,
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+12JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+22JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+32JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+42JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 0,
+ name => "multiple as single pem",
+ pem => <<'EOF',
+Subject: CN=some.test.content
+Issuer: CN=Org Issuing CA 3
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+Subject: CN=Org Issuing CA 3
+Issuer: CN=Org Root CA
+-----BEGIN CERTIFICATE-----
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "big pem",
+ multiple => 1,
+ pem => <<'EOF',
+Subject: CN=some.test.content
+Issuer: CN=Org Issuing CA 3
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+Subject: CN=Org Issuing CA 3
+Issuer: CN=Org Root CA
+-----BEGIN CERTIFICATE-----
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+Subject: CN=Org Root CA
+Issuer: CN=Org Root CA
+-----BEGIN CERTIFICATE-----
+3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+,
+ expected_result => << 'EOF',
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "other real pem",
+ pem => <<'EOF',
+Subject: CN=Some subject with 2 Points,O=A Organization,L=Some Lation,C=TT
+Issuer: CN=The Orgs Name RootCA 2015,O=The Orgs name Institutions Cert. Authority,L=Location,C=TT
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+,
+ expected_result => << 'EOF',
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 0,
+ name => "invalid single pem",
+ pem => <<'EOF',
+Subject: CN=Some subject with 2 Points,O=A Organization,L=Some Lation,C=TT
+Issuer: CN=The Orgs Name RootCA 2015,O=The Orgs name Institutions Cert. Authority,L=Location,C=TT
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdthese !?''*:;$%&/ are not allowedWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 0,
+ name => "invalid multi pem",
+ multiple => 1,
+ pem => <<'EOF',
+Subject: CN=Some subject with 2 Points,O=A Organization,L=Some Lation,C=TT
+Issuer: CN=The Orgs Name RootCA 2015,O=The Orgs name Institutions Cert. Authority,L=Location,C=TT
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdthese !?''*:;$%&/ are not allowedWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+Subject: CN=Some subject with 2 Points,O=A Organization,L=Some Lation,C=TT
+Issuer: CN=The Orgs Name RootCA 2015,O=The Orgs name Institutions Cert. Authority,L=Location,C=TT
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+
+EOF
+ },
+ {
+ successful => 1,
+ name => "single as multiple pem",
+ multiple => 1,
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdtheseZ2RmaXVwYWJ2aXV1YXdlYmxmamlraWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ }
+];
+
+for my $data ($setup->@*) {
+ # Act
+ my $check_result = PVE::Certificate::check_pem(
+ $data->{pem},
+ noerr => 1,
+ multiple => $data->{multiple},
+ label => $data->{label},
+ );
+
+ # Assert
+ if ($data->{successful}) {
+ ok($check_result, $data->{name} . " is successful");
+ } else {
+ ok(!$check_result, $data->{name} . " correctly rejected");
+ }
+
+ my $expected_result = $data->{expected_result}
+ ? $data->{expected_result}
+ : $data->{pem};
+
+ if ($data->{successful}) {
+ ok($check_result eq $expected_result, $data->{name} . " has correct check output");
+ } else {
+ ok(!defined($check_result), $data->{name} . " has correct check output");
+ }
+}
+
+done_testing();
diff --git a/test/split_pem_test.pl b/test/split_pem_test.pl
new file mode 100755
index 0000000..f7f7bc0
--- /dev/null
+++ b/test/split_pem_test.pl
@@ -0,0 +1,272 @@
+#!/usr/bin/perl
+# Tests the PVE::Certificate::split_pem function for
+# correctness and coverage of edgecases.
+
+use lib '../src';
+
+use Test::More;
+
+use PVE::Certificate;
+
+# Arrange
+my $setup = [
+ {
+ successful => 1,
+ name => "single pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+MIIBsjCCAVugAwIBAgIJAO2g8Z0dXk9tMAoGCCqGSM49BAMCMEUxCzAJBgNVBAYT
+AlVTMQswCQYDVQQIDAJDQTEQMA4GA1UEBwwHQmVya2VsZXkxEDAOBgNVBAoMB1Rl
+c3QgQ0EwHhcNMjAwMTAxMDAwMDAwWhcNMzAwMTAxMDAwMDAwWjBFMQswCQYDVQQG
+EwJVUzELMAkGA1UECAwCQ0ExEDAOBgNVBAcMB0JlcmtlbGV5MRAwDgYDVQQKDAdU
+ZXN0IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEv5Q8q1p7qZ2gqkQ0Qn5x
+0n9yqv8n8n7n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8aNT
+MFEwHQYDVR0OBBYEFOu2Y0bq8v3z7qkq1m1Qwqkq1m1QMB8GA1UdIwQYMBaAFOu2
+Y0bq8v3z7qkq1m1Qwqkq1m1QMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwID
+SAAwRQIhANfakefakefakefakefakefakefakefakefake
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "no extra text pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+12JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+22JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+32JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+42JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+,
+ expected_result => [
+ <<'EOF',
+-----BEGIN CERTIFICATE-----
+12JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+,
+ <<'EOF',
+-----BEGIN CERTIFICATE-----
+22JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+,
+ <<'EOF',
+-----BEGIN CERTIFICATE-----
+32JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+,
+ <<'EOF',
+-----BEGIN CERTIFICATE-----
+42JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+]
+ },
+ {
+ successful => 1,
+ name => "leading and interleaved text pem",
+ pem => <<'EOF',
+Subject: CN=some.test.content
+Issuer: CN=Org Issuing CA 3
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+Subject: CN=Org Issuing CA 3
+Issuer: CN=Org Root CA
+-----BEGIN CERTIFICATE-----
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+Subject: CN=Org Root CA
+Issuer: CN=Org Root CA
+-----BEGIN CERTIFICATE-----
+3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+,
+ expected_result => [
+<< 'EOF',
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+,
+ <<'EOF',
+-----BEGIN CERTIFICATE-----
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+,
+ <<'EOF',
+-----BEGIN CERTIFICATE-----
+3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+]
+ },
+ {
+ successful => 1,
+ name => "massive glob pem",
+ pem => <<'EOF',
+Subject: CN=some.test.content
+Issuer: CN=Org Issuing CA 3
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+Subject: CN=Org Issuing CA 3
+Issuer: CN=Org Root CA
+-----BEGIN CERTIFICATE-----
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+Subject: CN=Org Root CA
+Issuer: CN=Org Root CA
+-----BEGIN CERTIFICATE-----
+3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "no beginning pem",
+ pem => <<'EOF',
+Subject: CN=some.test.content
+Issuer: CN=Org Issuing CA 3
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+Subject: CN=Org Root CA
+Issuer: CN=Org Root CA
+3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+,
+ expected_result => [
+<< 'EOF',
+Subject: CN=some.test.content
+Issuer: CN=Org Issuing CA 3
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+,
+ <<'EOF',
+Subject: CN=Org Root CA
+Issuer: CN=Org Root CA
+3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+]
+
+ },
+ {
+ successful => 0,
+ name => "not a pem pem",
+ pem => <<'EOF',
+Subject: CN=some.test.content
+Issuer: CN=Org Issuing CA 3
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+Subject: CN=Org Issuing CA 3
+Issuer: CN=Org Root CA
+EOF
+ },
+ {
+ successful => 1,
+ name => "following text pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+32JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+42JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+some more text that we would like to remove
+EOF
+,
+ expected_result => [
+ <<'EOF',
+-----BEGIN CERTIFICATE-----
+32JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+,
+ <<'EOF',
+-----BEGIN CERTIFICATE-----
+42JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+]
+ }
+];
+
+for my $data ($setup->@*) {
+ # Act
+ my @split_result = PVE::Certificate::split_pem(
+ $data->{pem},
+ label => $data->{label}
+ );
+
+ # Assert
+ if ($data->{successful}) {
+ ok(@split_result, $data->{name} . " is successful");
+ } else {
+ ok(!@split_result, $data->{name} . " correctly rejected");
+ }
+
+ my $expected_result = $data->{expected_result}
+ ? $data->{expected_result}
+ : [ $data->{pem} ];
+
+ if ($data->{successful}) {
+ ok(@split_result eq @$expected_result, $data->{name} . " has correct check output");
+ } else {
+ ok(!@split_result eq @$expected_result, $data->{name} . " has correct check output");
+ }
+}
+
+done_testing();
--
2.47.3
^ permalink raw reply related [relevance 2%]
* [PATCH common/proxmox-acme v2 0/2] fix #5978: pem parser: relax parsing of chain entries
@ 2026-06-17 12:42 14% Thomas Ellmenreich
2026-06-17 12:42 2% ` [PATCH common v2 1/2] fix #5978: pem parser: relax parsing of chain entries: Thomas Ellmenreich
` (3 more replies)
0 siblings, 4 replies; 19+ results
From: Thomas Ellmenreich @ 2026-06-17 12:42 UTC (permalink / raw)
To: pve-devel; +Cc: Thomas Ellmenreich
According to RFC 8555, expected certchains should come
without whitespace or explanatory texts inbetween chain
entries. These two patches relax our parser to also
accept text or whitespaces inbetween chain entries.
pve-common:
Thomas Ellmenreich (1):
fix #5978: pem parser: relax parsing of chain entries:
src/PVE/Certificate.pm | 25 +++-
test/Makefile | 2 +
test/check_pem_test.pl | 332 +++++++++++++++++++++++++++++++++++++++++
test/split_pem_test.pl | 272 +++++++++++++++++++++++++++++++++
4 files changed, 625 insertions(+), 6 deletions(-)
create mode 100755 test/check_pem_test.pl
create mode 100755 test/split_pem_test.pl
proxmox-acme:
Thomas Ellmenreich (1):
fix #5978: pem parser: relax parsing of chain entries:
src/PVE/ACME.pm | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
Summary over all repositories:
5 files changed, 629 insertions(+), 10 deletions(-)
--
Generated by murpp 0.12.0
^ permalink raw reply [relevance 14%]
* [PATCH proxmox-acme v2 2/2] fix #5978: pem parser: relax parsing of chain entries:
2026-06-17 12:42 14% [PATCH common/proxmox-acme v2 " Thomas Ellmenreich
2026-06-17 12:42 2% ` [PATCH common v2 1/2] fix #5978: pem parser: relax parsing of chain entries: Thomas Ellmenreich
@ 2026-06-17 12:42 5% ` Thomas Ellmenreich
2026-06-24 10:57 5% ` Fabian Grünbichler
2026-06-24 11:38 5% ` Thomas Lamprecht
2026-06-17 13:21 5% ` [PATCH common/proxmox-acme v2 0/2] fix #5978: pem parser: relax parsing of chain entries Shannon Sterz
2026-07-03 10:57 5% ` superseded: " Thomas Ellmenreich
3 siblings, 2 replies; 19+ results
From: Thomas Ellmenreich @ 2026-06-17 12:42 UTC (permalink / raw)
To: pve-devel; +Cc: Thomas Ellmenreich
Instead of using a custom regex to parse pem chains, now uses
the pve-common Certificate::check_pem function to do so. This
now allows for additional text and whitespace inbetween the
chain entries.
Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
---
src/PVE/ACME.pm | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
index e6fb9c2..4b06817 100644
--- a/src/PVE/ACME.pm
+++ b/src/PVE/ACME.pm
@@ -530,10 +530,10 @@ sub get_certificate {
if !defined($res);
}
- if ($res =~ /^(-----BEGIN CERTIFICATE-----)(.+)(-----END CERTIFICATE-----)$/s) { # untaint
- return $1 . $2 . $3;
- }
- die "Server reply does not look like a PEM encoded certificate\n";
+ my $parsed = eval { PVE::Certificate::check_pem->($res) };
+ die "Server reply does not look like a PEM encoded certificate: $@\n"
+ if $@;
+ return $parsed;
};
$self->fatal("POST of '$order->{certificate}' failed - $@", $r) if $@;
return $return;
--
2.47.3
^ permalink raw reply related [relevance 5%]
* Re: [PATCH proxmox-acme 2/2] fix #5978: pem parser: relax parsing of chain entries:
2026-06-09 13:15 5% ` [PATCH proxmox-acme 2/2] " Thomas Ellmenreich
@ 2026-06-15 11:34 5% ` Fabian Grünbichler
0 siblings, 0 replies; 19+ results
From: Fabian Grünbichler @ 2026-06-15 11:34 UTC (permalink / raw)
To: pve-devel, Thomas Ellmenreich
On June 9, 2026 3:15 pm, Thomas Ellmenreich wrote:
> Instead of using a custom regex to parse pem chains, now uses
> the pve-common Certificate::check_pem function to do so. This
> now allows for additional text and whitespace inbetween the
> chain entries.
>
> Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
> ---
> src/PVE/ACME.pm | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
> index e6fb9c2..ff10c22 100644
> --- a/src/PVE/ACME.pm
> +++ b/src/PVE/ACME.pm
> @@ -530,9 +530,11 @@ sub get_certificate {
> if !defined($res);
> }
>
> - if ($res =~ /^(-----BEGIN CERTIFICATE-----)(.+)(-----END CERTIFICATE-----)$/s) { # untaint
> - return $1 . $2 . $3;
> - }
> + my $checked = PVE::Certificate::check_pem->($res, no_err => 1);
no_err is actually noerr in PVE::Certificate, so setting it this way has
no effect. but I don't think we need to set it here at all, we can
simply do
return PVE::Certificate::check_pem($res);
it will either die (with a hopefully meaningful error), or return the
cleaned up PEM data.
if you want to customize the error message, something like
my $res = eval { ... };
die "Server reply does not look like a PEM encoded certificate: $@\n"
if $@;
return $res;
would be a common pattern we use in our code. eval {} is similar to
try/catch in other languages, if the code in the body dies with a fatal
error, it is stored in $@ which can be checked after.
setting noerr is usually reserved for parsing where an error is not
fatal. e.g. if we wanted to parse the data here with multiple possible
labels, we might set noerr for each attempt and only die with an error
if we find no label.
> + if (defined $checked) {
> + return $checked;
> + }
nit the last line here has trailing whitespace (you can configure your
editor or git to make this more obvious, e.g. mark it as red)
> +
> die "Server reply does not look like a PEM encoded certificate\n";
> };
> $self->fatal("POST of '$order->{certificate}' failed - $@", $r) if $@;
> --
> 2.47.3
>
>
>
>
>
>
^ permalink raw reply [relevance 5%]
* Re: [PATCH common 1/2] fix #5978: pem parser: relax parsing of chain entries:
2026-06-09 13:15 4% ` [PATCH common 1/2] fix #5978: pem parser: relax parsing of chain entries: Thomas Ellmenreich
@ 2026-06-15 11:34 5% ` Fabian Grünbichler
0 siblings, 0 replies; 19+ results
From: Fabian Grünbichler @ 2026-06-15 11:34 UTC (permalink / raw)
To: pve-devel, Thomas Ellmenreich
On June 9, 2026 3:15 pm, Thomas Ellmenreich wrote:
> Relaxes the parser to allow for text and whitespaces inbetween certchain
> entries, thus also refactored the extraction to only extract chain entries
> from the string.
>
> Added testsuite to cover a bunch of parsing edge cases.
>
> Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
> ---
> src/PVE/Certificate.pm | 23 ++--
> test/Makefile | 1 +
> test/check_pem_test.pl | 264 +++++++++++++++++++++++++++++++++++++++++
> 3 files changed, 276 insertions(+), 12 deletions(-)
> create mode 100755 test/check_pem_test.pl
>
> diff --git a/src/PVE/Certificate.pm b/src/PVE/Certificate.pm
> index b8415e2..fc45b63 100644
> --- a/src/PVE/Certificate.pm
> +++ b/src/PVE/Certificate.pm
> @@ -136,24 +136,23 @@ sub strip_leading_text {
>
> sub split_pem {
> my ($content, %opts) = @_;
> - my $label = $opts{label} // 'CERTIFICATE';
> +
nit: trailing whitespace here
> + my $re = $pem_re->($opts{label} // 'CERTIFICATE');
>
> - my $header = $header_re->($label);
> - return split(/(?=$header)/, $content);
> + if (!$content =~ /^$re$/) {
> + return undef if $opts{noerr};
> + die "not a valid PEM-formatted string.\n";
> + }
this changes the behaviour quite substantially though - previously the
input string was just split at the header lines. now it requires the
whole file to be valid PEM. but it seems this is only called by the ACME
code anyway.
I was quite confused though how this works with the test cases below,
after all $pem_re does not accept leading or trailing text after the
first header or last footer.
then I spotted it - what you actually wanted there is:
if ($content !~ /^$re$/) {
}
which actually causes 10 of the 25 test cases to fail, because there is
no handling of leading or trailing or interspersed non-PEM text here.
perl can be quite tricky because it has call-site context dependenct
behaviour changing the return type and value of a called function, and
operator binding can be a bit tricky sometimes.
in list context, =~ will return the matches of the RE (similar to how $N
are set afterwards if there were matches). in scalar context, it will
return whether there was a match or not.
so
if ($content =~ /^$re$/) {
..
}
will evaluate to true for a match, and false if there is none. inverting
it by changing =~ to !~ works as expected.
but tacking on a ! at the front actually evaluates to
if ((!$content) =~ /^$re$/) {
..
}
because ! has higher precedence than =~ and !~
negating a string is just a false value (unless the string is completely
empty ;)), and that will never match our regular expression here.
> +
> + my @pem_chain = $content =~ /($re)/sg;
the list context part you can actually see in effect here.
> + return @pem_chain;
> }
>
> sub check_pem {
> my ($content, %opts) = @_;
>
> - $content = strip_leading_text($content);
> -
> - my $re = $pem_re->($opts{label} // 'CERTIFICATE');
> - $re = qr/($re\n+)*$re/ if $opts{multiple};
> -
> - return $content if $content =~ /^$re$/; # OK
> -
> - return undef if $opts{noerr};
> - die "not a valid PEM-formatted string.\n";
> + my @result = split_pem($content, %opts);
> + return join("", @result);
switching like this will now always allow multiple PEM-encoded things,
which previously required an opt-in..
> }
>
> sub pem_to_der {
> diff --git a/test/Makefile b/test/Makefile
> index 9b9f81b..de6ae60 100644
> --- a/test/Makefile
> +++ b/test/Makefile
> @@ -14,6 +14,7 @@ TESTS = lock_file.test \
> is_deeply_test.test \
> section_config_property_isolation_test.pl \
> file-test.pl \
> + check_pem_test.pl \
>
> all:
>
> diff --git a/test/check_pem_test.pl b/test/check_pem_test.pl
> new file mode 100755
> index 0000000..dc5fd7e
> --- /dev/null
> +++ b/test/check_pem_test.pl
> @@ -0,0 +1,264 @@
> +#!/usr/bin/perl
> +# Tests the PVE::Certificate::check_pem and the
> +# PVE::Certificate::split_pem function for
> +# correctness and coverage of edgecases.
nit: this only indirectly tests split_pem, so I'd drop that part or add
actual test cases for verifying the splitting as well.
> +
> +use lib '../src';
> +
> +use Test::More;
> +
> +use PVE::Certificate;
> +
> +# Arrange
> +my $setup = [
> + {
> + successful => 1,
> + name => "full pem",
> + pem => <<'EOF',
> +-----BEGIN CERTIFICATE-----
> +MIIBsjCCAVugAwIBAgIJAO2g8Z0dXk9tMAoGCCqGSM49BAMCMEUxCzAJBgNVBAYT
> +AlVTMQswCQYDVQQIDAJDQTEQMA4GA1UEBwwHQmVya2VsZXkxEDAOBgNVBAoMB1Rl
> +c3QgQ0EwHhcNMjAwMTAxMDAwMDAwWhcNMzAwMTAxMDAwMDAwWjBFMQswCQYDVQQG
> +EwJVUzELMAkGA1UECAwCQ0ExEDAOBgNVBAcMB0JlcmtlbGV5MRAwDgYDVQQKDAdU
> +ZXN0IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEv5Q8q1p7qZ2gqkQ0Qn5x
> +0n9yqv8n8n7n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8aNT
> +MFEwHQYDVR0OBBYEFOu2Y0bq8v3z7qkq1m1Qwqkq1m1QMB8GA1UdIwQYMBaAFOu2
> +Y0bq8v3z7qkq1m1Qwqkq1m1QMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwID
> +SAAwRQIhANfakefakefakefakefakefakefakefakefake
> +-----END CERTIFICATE-----
> +EOF
> + },
> + {
> + successful => 1,
> + name => "other label pem",
> + label => "SOME LABEL",
> + pem => <<'EOF',
> +-----BEGIN SOME LABEL-----
> +MIIBsjCCAVugAwIBAgIJAO2g8Z0dXk9tMAoGCCqGSM49BAMCMEUxCzAJBgNVBAYT
> +AlVTMQswCQYDVQQIDAJDQTEQMA4GA1UEBwwHQmVya2VsZXkxEDAOBgNVBAoMB1Rl
> +c3QgQ0EwHhcNMjAwMTAxMDAwMDAwWhcNMzAwMTAxMDAwMDAwWjBFMQswCQYDVQQG
> +EwJVUzELMAkGA1UECAwCQ0ExEDAOBgNVBAcMB0JlcmtlbGV5MRAwDgYDVQQKDAdU
> +ZXN0IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEv5Q8q1p7qZ2gqkQ0Qn5x
> +0n9yqv8n8n7n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8aNT
> +MFEwHQYDVR0OBBYEFOu2Y0bq8v3z7qkq1m1Qwqkq1m1QMB8GA1UdIwQYMBaAFOu2
> +Y0bq8v3z7qkq1m1Qwqkq1m1QMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwID
> +SAAwRQIhANfakefakefakefakefakefakefakefakefake
> +-----END SOME LABEL-----
> +EOF
> + },
> + {
> + successful => 1,
> + name => "simple pem",
> + pem => <<'EOF',
> +-----BEGIN CERTIFICATE-----
> +test
> +-----END CERTIFICATE-----
> +EOF
> + },
> + {
> + successful => 1,
> + name => "spaced out pem",
> + pem => <<'EOF',
> +-----BEGIN CERTIFICATE-----
> +
> +test
> +
> +-----END CERTIFICATE-----
> +EOF
> + },
> + {
> + successful => 1,
> + name => "only newline pem",
> + pem => <<'EOF',
> +-----BEGIN CERTIFICATE-----
> +-----END CERTIFICATE-----
> +EOF
> + },
> + {
> + successful => 1,
> + name => "many newlines pem",
> + pem => <<'EOF',
> +-----BEGIN CERTIFICATE-----
> +
> +
> +
> +-----END CERTIFICATE-----
> +EOF
> + },
> + {
> + successful => 0,
> + name => "no content pem",
> + pem => <<'EOF',
> +-----BEGIN CERTIFICATE----------END CERTIFICATE-----
> +EOF
> + },
> + {
> + successful => 1,
> + name => "preceding content pem",
> + pem => <<'EOF',
> +some extended content
> +-----BEGIN CERTIFICATE-----
> +test
> +-----END CERTIFICATE-----
> +EOF
> +,
> + expected_result => << 'EOF',
> +-----BEGIN CERTIFICATE-----
> +test
> +-----END CERTIFICATE-----
> +EOF
> + },
> + {
> + successful => 1,
> + name => "following content pem",
> + pem => <<'EOF',
> +-----BEGIN CERTIFICATE-----
> +test
> +-----END CERTIFICATE-----
> +some extended content
> +EOF
> +,
> + expected_result => << 'EOF',
> +-----BEGIN CERTIFICATE-----
> +test
> +-----END CERTIFICATE-----
> +EOF
> + },
> + {
> + successful => 0,
> + name => "empty pem",
> + pem => <<'EOF',
> +
> +EOF
> + },
> + {
> + successful => 0,
> + name => "upsidedown pem",
> + pem => <<'EOF',
> +-----END CERTIFICATE-----
> +test
> +-----BEGIN CERTIFICATE-----
> +EOF
> + },
> + {
> + successful => 1,
> + name => "multi pem",
> + multiple => 1,
> + pem => <<'EOF',
> +-----BEGIN CERTIFICATE-----
> +12JlZ2tseTxzZWl2IGF3ZWlidm4=
> +-----END CERTIFICATE-----
> +-----BEGIN CERTIFICATE-----
> +22JlZ2tseTxzZWl2IGF3ZWlidm4=
> +-----END CERTIFICATE-----
> +-----BEGIN CERTIFICATE-----
> +32JlZ2tseTxzZWl2IGF3ZWlidm4=
> +-----END CERTIFICATE-----
> +-----BEGIN CERTIFICATE-----
> +42JlZ2tseTxzZWl2IGF3ZWlidm4=
> +-----END CERTIFICATE-----
> +EOF
> + },
> + {
> + successful => 1,
> + name => "big pem",
> + multiple => 1,
> + pem => <<'EOF',
> +Subject: CN=some.test.content
> +Issuer: CN=Org Issuing CA 3
> +-----BEGIN CERTIFICATE-----
> +1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
> +dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
> +dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
> +c2JlZ2tseTxzZWl2IGF3ZWlidm4=
> +-----END CERTIFICATE-----
> +Subject: CN=Org Issuing CA 3
> +Issuer: CN=Org Root CA
> +-----BEGIN CERTIFICATE-----
> +2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
> +dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
> +dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
> +c2JlZ2tseTxzZWl2IGF3ZWlidm4=
> +-----END CERTIFICATE-----
> +Subject: CN=Org Root CA
> +Issuer: CN=Org Root CA
> +-----BEGIN CERTIFICATE-----
> +3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
> +dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
> +dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
> +c2JlZ2tseTxzZWl2IGF3ZWlidm4=
> +-----END CERTIFICATE-----
> +EOF
> +,
> + expected_result => << 'EOF',
> +-----BEGIN CERTIFICATE-----
> +1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
> +dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
> +dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
> +c2JlZ2tseTxzZWl2IGF3ZWlidm4=
> +-----END CERTIFICATE-----
> +-----BEGIN CERTIFICATE-----
> +2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
> +dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
> +dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
> +c2JlZ2tseTxzZWl2IGF3ZWlidm4=
> +-----END CERTIFICATE-----
> +-----BEGIN CERTIFICATE-----
> +3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
> +dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
> +dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
> +c2JlZ2tseTxzZWl2IGF3ZWlidm4=
> +-----END CERTIFICATE-----
> +EOF
> + },
> + {
> + successful => 1,
> + name => "other real pem",
> + pem => <<'EOF',
> +Subject: CN=Some subject with 2 Points,O=A Organization,L=Some Lation,C=TT
> +Issuer: CN=The Orgs Name RootCA 2015,O=The Orgs name Institutions Cert. Authority,L=Location,C=TT
> +-----BEGIN CERTIFICATE-----
> +1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
> +dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
> +dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
> +c2JlZ2tseTxzZWl2IGF3ZWlidm4=
> +-----END CERTIFICATE-----
> +EOF
> +,
> + expected_result => << 'EOF',
> +-----BEGIN CERTIFICATE-----
> +1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
> +dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
> +dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
> +c2JlZ2tseTxzZWl2IGF3ZWlidm4=
> +-----END CERTIFICATE-----
> +EOF
> + }
> +];
> +
> +for my $data ($setup->@*) {
> + # Act
> + my $check_result = PVE::Certificate::check_pem(
> + $data->{pem},
> + noerr => 1,
> + multiple => $data->{multiple},
> + label => $data->{label},
> + );
> +
> + # Assert
> + if($data->{successful}) {
nit: missing space between if and (
> + ok($check_result, $data->{name} . " accepted");
> + } else {
> + ok(!$check_result, $data->{name} . " correctly rejected");
> + }
> +
> + my $expected_result = $data->{expected_result}
> + ? $data->{expected_result}
> + : $data->{pem};
> +
> + if ($data->{successful}) {
> + ok($check_result eq $expected_result, $data->{name} . " has correct check output");
> + }
these could all move into the first branch of the if above
> +}
> +
> +done_testing();
> --
> 2.47.3
>
>
>
>
>
>
^ permalink raw reply [relevance 5%]
* [PATCH common 1/2] fix #5978: pem parser: relax parsing of chain entries:
2026-06-09 13:15 14% [PATCH common/proxmox-acme 0/2] fix #5978: pem parser: relax parsing of chain entries Thomas Ellmenreich
@ 2026-06-09 13:15 4% ` Thomas Ellmenreich
2026-06-15 11:34 5% ` Fabian Grünbichler
2026-06-09 13:15 5% ` [PATCH proxmox-acme 2/2] " Thomas Ellmenreich
2026-06-17 12:55 5% ` superseded: [PATCH common/proxmox-acme 0/2] fix #5978: pem parser: relax parsing of chain entries Thomas Ellmenreich
2 siblings, 1 reply; 19+ results
From: Thomas Ellmenreich @ 2026-06-09 13:15 UTC (permalink / raw)
To: pve-devel; +Cc: Thomas Ellmenreich
Relaxes the parser to allow for text and whitespaces inbetween certchain
entries, thus also refactored the extraction to only extract chain entries
from the string.
Added testsuite to cover a bunch of parsing edge cases.
Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
---
src/PVE/Certificate.pm | 23 ++--
test/Makefile | 1 +
test/check_pem_test.pl | 264 +++++++++++++++++++++++++++++++++++++++++
3 files changed, 276 insertions(+), 12 deletions(-)
create mode 100755 test/check_pem_test.pl
diff --git a/src/PVE/Certificate.pm b/src/PVE/Certificate.pm
index b8415e2..fc45b63 100644
--- a/src/PVE/Certificate.pm
+++ b/src/PVE/Certificate.pm
@@ -136,24 +136,23 @@ sub strip_leading_text {
sub split_pem {
my ($content, %opts) = @_;
- my $label = $opts{label} // 'CERTIFICATE';
+
+ my $re = $pem_re->($opts{label} // 'CERTIFICATE');
- my $header = $header_re->($label);
- return split(/(?=$header)/, $content);
+ if (!$content =~ /^$re$/) {
+ return undef if $opts{noerr};
+ die "not a valid PEM-formatted string.\n";
+ }
+
+ my @pem_chain = $content =~ /($re)/sg;
+ return @pem_chain;
}
sub check_pem {
my ($content, %opts) = @_;
- $content = strip_leading_text($content);
-
- my $re = $pem_re->($opts{label} // 'CERTIFICATE');
- $re = qr/($re\n+)*$re/ if $opts{multiple};
-
- return $content if $content =~ /^$re$/; # OK
-
- return undef if $opts{noerr};
- die "not a valid PEM-formatted string.\n";
+ my @result = split_pem($content, %opts);
+ return join("", @result);
}
sub pem_to_der {
diff --git a/test/Makefile b/test/Makefile
index 9b9f81b..de6ae60 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -14,6 +14,7 @@ TESTS = lock_file.test \
is_deeply_test.test \
section_config_property_isolation_test.pl \
file-test.pl \
+ check_pem_test.pl \
all:
diff --git a/test/check_pem_test.pl b/test/check_pem_test.pl
new file mode 100755
index 0000000..dc5fd7e
--- /dev/null
+++ b/test/check_pem_test.pl
@@ -0,0 +1,264 @@
+#!/usr/bin/perl
+# Tests the PVE::Certificate::check_pem and the
+# PVE::Certificate::split_pem function for
+# correctness and coverage of edgecases.
+
+use lib '../src';
+
+use Test::More;
+
+use PVE::Certificate;
+
+# Arrange
+my $setup = [
+ {
+ successful => 1,
+ name => "full pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+MIIBsjCCAVugAwIBAgIJAO2g8Z0dXk9tMAoGCCqGSM49BAMCMEUxCzAJBgNVBAYT
+AlVTMQswCQYDVQQIDAJDQTEQMA4GA1UEBwwHQmVya2VsZXkxEDAOBgNVBAoMB1Rl
+c3QgQ0EwHhcNMjAwMTAxMDAwMDAwWhcNMzAwMTAxMDAwMDAwWjBFMQswCQYDVQQG
+EwJVUzELMAkGA1UECAwCQ0ExEDAOBgNVBAcMB0JlcmtlbGV5MRAwDgYDVQQKDAdU
+ZXN0IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEv5Q8q1p7qZ2gqkQ0Qn5x
+0n9yqv8n8n7n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8aNT
+MFEwHQYDVR0OBBYEFOu2Y0bq8v3z7qkq1m1Qwqkq1m1QMB8GA1UdIwQYMBaAFOu2
+Y0bq8v3z7qkq1m1Qwqkq1m1QMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwID
+SAAwRQIhANfakefakefakefakefakefakefakefakefake
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "other label pem",
+ label => "SOME LABEL",
+ pem => <<'EOF',
+-----BEGIN SOME LABEL-----
+MIIBsjCCAVugAwIBAgIJAO2g8Z0dXk9tMAoGCCqGSM49BAMCMEUxCzAJBgNVBAYT
+AlVTMQswCQYDVQQIDAJDQTEQMA4GA1UEBwwHQmVya2VsZXkxEDAOBgNVBAoMB1Rl
+c3QgQ0EwHhcNMjAwMTAxMDAwMDAwWhcNMzAwMTAxMDAwMDAwWjBFMQswCQYDVQQG
+EwJVUzELMAkGA1UECAwCQ0ExEDAOBgNVBAcMB0JlcmtlbGV5MRAwDgYDVQQKDAdU
+ZXN0IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEv5Q8q1p7qZ2gqkQ0Qn5x
+0n9yqv8n8n7n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8n8aNT
+MFEwHQYDVR0OBBYEFOu2Y0bq8v3z7qkq1m1Qwqkq1m1QMB8GA1UdIwQYMBaAFOu2
+Y0bq8v3z7qkq1m1Qwqkq1m1QMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwID
+SAAwRQIhANfakefakefakefakefakefakefakefakefake
+-----END SOME LABEL-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "simple pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+test
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "spaced out pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+
+test
+
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "only newline pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "many newlines pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+
+
+
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 0,
+ name => "no content pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE----------END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "preceding content pem",
+ pem => <<'EOF',
+some extended content
+-----BEGIN CERTIFICATE-----
+test
+-----END CERTIFICATE-----
+EOF
+,
+ expected_result => << 'EOF',
+-----BEGIN CERTIFICATE-----
+test
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "following content pem",
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+test
+-----END CERTIFICATE-----
+some extended content
+EOF
+,
+ expected_result => << 'EOF',
+-----BEGIN CERTIFICATE-----
+test
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 0,
+ name => "empty pem",
+ pem => <<'EOF',
+
+EOF
+ },
+ {
+ successful => 0,
+ name => "upsidedown pem",
+ pem => <<'EOF',
+-----END CERTIFICATE-----
+test
+-----BEGIN CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "multi pem",
+ multiple => 1,
+ pem => <<'EOF',
+-----BEGIN CERTIFICATE-----
+12JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+22JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+32JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+42JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "big pem",
+ multiple => 1,
+ pem => <<'EOF',
+Subject: CN=some.test.content
+Issuer: CN=Org Issuing CA 3
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+Subject: CN=Org Issuing CA 3
+Issuer: CN=Org Root CA
+-----BEGIN CERTIFICATE-----
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+Subject: CN=Org Root CA
+Issuer: CN=Org Root CA
+-----BEGIN CERTIFICATE-----
+3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+,
+ expected_result => << 'EOF',
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+2WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+3WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ },
+ {
+ successful => 1,
+ name => "other real pem",
+ pem => <<'EOF',
+Subject: CN=Some subject with 2 Points,O=A Organization,L=Some Lation,C=TT
+Issuer: CN=The Orgs Name RootCA 2015,O=The Orgs name Institutions Cert. Authority,L=Location,C=TT
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+,
+ expected_result => << 'EOF',
+-----BEGIN CERTIFICATE-----
+1WtzZGhmbGtqYXNoZ2RmaXVwYWJ2aXV1YXdlYmxmamlraGFzZGtmYWlzdXBkdW5i
+dmFpdXdlYmdmw7ZrYWpkc2JoZmdpYXNkbmJpZnVhYmdzaWprZmdyYXNkaHJmaW9h
+dXNkbmF1c2JmZ3ZramFzZGJma2phc2RibmZpanVhIHNkb3ZuYmF3b3VlYmZnb2F3
+c2JlZ2tseTxzZWl2IGF3ZWlidm4=
+-----END CERTIFICATE-----
+EOF
+ }
+];
+
+for my $data ($setup->@*) {
+ # Act
+ my $check_result = PVE::Certificate::check_pem(
+ $data->{pem},
+ noerr => 1,
+ multiple => $data->{multiple},
+ label => $data->{label},
+ );
+
+ # Assert
+ if($data->{successful}) {
+ ok($check_result, $data->{name} . " accepted");
+ } else {
+ ok(!$check_result, $data->{name} . " correctly rejected");
+ }
+
+ my $expected_result = $data->{expected_result}
+ ? $data->{expected_result}
+ : $data->{pem};
+
+ if ($data->{successful}) {
+ ok($check_result eq $expected_result, $data->{name} . " has correct check output");
+ }
+}
+
+done_testing();
--
2.47.3
^ permalink raw reply related [relevance 4%]
* [PATCH proxmox-acme 2/2] fix #5978: pem parser: relax parsing of chain entries:
2026-06-09 13:15 14% [PATCH common/proxmox-acme 0/2] fix #5978: pem parser: relax parsing of chain entries Thomas Ellmenreich
2026-06-09 13:15 4% ` [PATCH common 1/2] fix #5978: pem parser: relax parsing of chain entries: Thomas Ellmenreich
@ 2026-06-09 13:15 5% ` Thomas Ellmenreich
2026-06-15 11:34 5% ` Fabian Grünbichler
2026-06-17 12:55 5% ` superseded: [PATCH common/proxmox-acme 0/2] fix #5978: pem parser: relax parsing of chain entries Thomas Ellmenreich
2 siblings, 1 reply; 19+ results
From: Thomas Ellmenreich @ 2026-06-09 13:15 UTC (permalink / raw)
To: pve-devel; +Cc: Thomas Ellmenreich
Instead of using a custom regex to parse pem chains, now uses
the pve-common Certificate::check_pem function to do so. This
now allows for additional text and whitespace inbetween the
chain entries.
Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
---
src/PVE/ACME.pm | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
index e6fb9c2..ff10c22 100644
--- a/src/PVE/ACME.pm
+++ b/src/PVE/ACME.pm
@@ -530,9 +530,11 @@ sub get_certificate {
if !defined($res);
}
- if ($res =~ /^(-----BEGIN CERTIFICATE-----)(.+)(-----END CERTIFICATE-----)$/s) { # untaint
- return $1 . $2 . $3;
- }
+ my $checked = PVE::Certificate::check_pem->($res, no_err => 1);
+ if (defined $checked) {
+ return $checked;
+ }
+
die "Server reply does not look like a PEM encoded certificate\n";
};
$self->fatal("POST of '$order->{certificate}' failed - $@", $r) if $@;
--
2.47.3
^ permalink raw reply related [relevance 5%]
* [PATCH common/proxmox-acme 0/2] fix #5978: pem parser: relax parsing of chain entries
@ 2026-06-09 13:15 14% Thomas Ellmenreich
2026-06-09 13:15 4% ` [PATCH common 1/2] fix #5978: pem parser: relax parsing of chain entries: Thomas Ellmenreich
` (2 more replies)
0 siblings, 3 replies; 19+ results
From: Thomas Ellmenreich @ 2026-06-09 13:15 UTC (permalink / raw)
To: pve-devel; +Cc: Thomas Ellmenreich
According to RFC 8555, expected certchains should come
without whitespace or explanatory texts inbetween chain
entries. These two patches relax our parser to also
accept text or whitespaces inbetween chain entries.
pve-common:
Thomas Ellmenreich (1):
fix #5978: pem parser: relax parsing of chain entries:
src/PVE/Certificate.pm | 23 ++--
test/Makefile | 1 +
test/check_pem_test.pl | 264 +++++++++++++++++++++++++++++++++++++++++
3 files changed, 276 insertions(+), 12 deletions(-)
create mode 100755 test/check_pem_test.pl
proxmox-acme:
Thomas Ellmenreich (1):
fix #5978: pem parser: relax parsing of chain entries:
src/PVE/ACME.pm | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
Summary over all repositories:
4 files changed, 281 insertions(+), 15 deletions(-)
--
Generated by murpp 0.12.0
^ permalink raw reply [relevance 14%]
Results 1-19 of 19 | reverse | options above
-- pct% links below jump to the message on this page, permalinks otherwise --
2026-06-09 13:15 14% [PATCH common/proxmox-acme 0/2] fix #5978: pem parser: relax parsing of chain entries Thomas Ellmenreich
2026-06-09 13:15 4% ` [PATCH common 1/2] fix #5978: pem parser: relax parsing of chain entries: Thomas Ellmenreich
2026-06-15 11:34 5% ` Fabian Grünbichler
2026-06-09 13:15 5% ` [PATCH proxmox-acme 2/2] " Thomas Ellmenreich
2026-06-15 11:34 5% ` Fabian Grünbichler
2026-06-17 12:55 5% ` superseded: [PATCH common/proxmox-acme 0/2] fix #5978: pem parser: relax parsing of chain entries Thomas Ellmenreich
2026-06-17 12:42 14% [PATCH common/proxmox-acme v2 " Thomas Ellmenreich
2026-06-17 12:42 2% ` [PATCH common v2 1/2] fix #5978: pem parser: relax parsing of chain entries: Thomas Ellmenreich
2026-06-24 9:27 5% ` Thomas Lamprecht
2026-06-24 10:57 4% ` Fabian Grünbichler
2026-06-17 12:42 5% ` [PATCH proxmox-acme v2 2/2] " Thomas Ellmenreich
2026-06-24 10:57 5% ` Fabian Grünbichler
2026-06-24 11:38 5% ` Thomas Lamprecht
2026-06-17 13:21 5% ` [PATCH common/proxmox-acme v2 0/2] fix #5978: pem parser: relax parsing of chain entries Shannon Sterz
2026-06-18 8:46 5% ` Thomas Ellmenreich
2026-07-03 10:57 5% ` superseded: " Thomas Ellmenreich
2026-07-03 10:51 13% [PATCH common/proxmox-acme v3 " Thomas Ellmenreich
2026-07-03 10:51 2% ` [PATCH common v3 1/2] " Thomas Ellmenreich
2026-07-03 10:51 5% ` [PATCH proxmox-acme v3 2/2] fix #5978: pem parser: relax parsing of chain entries: Thomas Ellmenreich
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox