Re: [PATCH proxmox-acme v4 3/3] fix #5978: pem parser: relax parsing of chain entries:

["Elias Huhsovitz" <e.huhsovitz@proxmox.com>]

Good standardization!

Test methodology explained in review 1/3.

Reviewed-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>
Tested-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>

On Wed Aug 5, 2026 at 4:11 PM CEST, Thomas Ellmenreich wrote:
> Instead of using a custom regex to parse pem chains, now uses
> the pve-common Certificate::check_pem function to do so. This
> now allows for additional text and whitespace inbetween the
> chain entries.
>
> Signed-off-by: Thomas Ellmenreich <t.ellmenreich@proxmox.com>
> ---
>  src/PVE/ACME.pm | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
> index e6fb9c2..665087b 100644
> --- a/src/PVE/ACME.pm
> +++ b/src/PVE/ACME.pm
> @@ -526,14 +526,16 @@ sub get_certificate {
>                      }
>                  }
>              }
> -            die "no matching alternate chain for '$root' returned by server\n"
> +            die "no matching alternate chain for '$root' provided by the acme server\n"
>                  if !defined($res);
>          }
>  
> -        if ($res =~ /^(-----BEGIN CERTIFICATE-----)(.+)(-----END CERTIFICATE-----)$/s) { # untaint
> -            return $1 . $2 . $3;
> -        }
> -        die "Server reply does not look like a PEM encoded certificate\n";
> +        my $parsed = eval { PVE::Certificate::check_pem($res, multiple => 1) };
> +        chomp(my $error = $@);
> +        die
> +            "value returned by ACME certificate url does not look like a PEM encoded certificate: " . $error . "\n"
> +            if $error;
> +        return $parsed;
>      };
>      $self->fatal("POST of '$order->{certificate}' failed - $@", $r) if $@;
>      return $return;