[pve-devel] [PATCH proxmox-acme] support downloading alternate chains

[Fabian Grünbichler]

the current default chains end with an expired root certificate for
maximum compatibility with old Android versions. this breaks some other
older clients (openssl, gnutls) which don't expect chains to contain any
expired certificates, even if they are 'above' the trust anchor.

setting $root will download alternate chains provided by the ACME server
and try to find a chain matching this (sub)string either as subject or
issuer of the last element of the certificate chain.

Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
---

Notes:
    only tested with pebble

    writing to a tempfile is a bit ugly, but we are not talking about
    much data here, and the alternative is to have a versioned bump for
    pve-common to teach the cert helper to read from a string/buffer..

 src/PVE/ACME.pm | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/src/PVE/ACME.pm b/src/PVE/ACME.pm
index 265482d..0684815 100644
--- a/src/PVE/ACME.pm
+++ b/src/PVE/ACME.pm
@@ -442,10 +442,11 @@ sub deactivate_authorization {
 
 # Get certificate
 # GET-as-POST to order's certificate URL
+# if $root is specified, attempts to find a matching alternate chain
 # Expects a '200 OK' reply
 # returns certificate chain in PEM format
 sub get_certificate {
-    my ($self, $order) = @_;
+    my ($self, $order, $root) = @_;
 
     $self->fatal("no certificate URL available (yet?)", $order)
        if !$order->{certificate};
@@ -453,6 +454,28 @@ sub get_certificate {
     my $r = $self->do(POST => $order->{certificate}, '');
     my $return = eval {
 	my $res = __get_result($r, 200, 1);
+	if ($root) {
+	    my $found;
+	    my @links = $r->header('link');
+	    for my $link (@links) {
+		if ($link =~ /^<(.*)>;rel="alternate"$/) {
+		    my $url = $1;
+		    my $chain = eval { __get_result($self->do(POST => $url, ''), 200, 1); };
+		    die "failed to retrieve alternate chain from '$url' - $@\n" if $@;
+		    my @certs = PVE::Certificate::split_pem($chain);
+		    my $root_pem = $certs[-1];
+		    my ($file, $fh) = PVE::Tools::tempfile_contents($root_pem);
+		    my $info = PVE::Certificate::get_certificate_info($file);
+		    if ((defined($info->{subject}) && $info->{subject} =~ m/\Q$root\E/)
+			|| (defined($info->{issuer}) && $info->{issuer} =~ m/\Q$root\E/)) {
+			$res = $chain;
+			$found = 1;
+			last;
+		    }
+		}
+	    }
+	    die "didn't find alternate chain matching '$root'\n" if !$found;
+	}
 	if ($res =~ /^(-----BEGIN CERTIFICATE-----)(.+)(-----END CERTIFICATE-----)$/s) { # untaint
 	    return $1 . $2 . $3;
 	}
-- 
2.30.2