Conversation

Notices

1. Embed this notice
   Thib (thibaultamartin@mamot.fr)'s status on Tuesday, 19-Aug-2025 22:30:47 JST Thib

   I might have found a bug in Proxmox, but I somehow doubt I'm the first person to stumble upon it.

   TLDR: Proxmox generates a self-signed certificate that I want my laptop to trust, but it looks like the CA cert is missing a crucial key usage extension.

   Have you already stumbled upon it? Am I holding it wrong?

   https://forum.proxmox.com/threads/the-root-ca-seems-doesnt-contain-the-key-usage-extension.169961/

   #selfHosting #proxmox #homelab

   • Embed this notice
     Mauricio Teixeira 🇧🇷🇺🇲 (badnetmask@hachyderm.io)'s status on Tuesday, 19-Aug-2025 22:30:43 JST Mauricio Teixeira 🇧🇷🇺🇲

     in reply to

     • Lars

     @thibaultamartin @koyax @mmeier
     I would not at all be surprised if that was done on purpose, to make you want to create a proper certificate (even if using a private CA).

   • Embed this notice
     Thib (thibaultamartin@mamot.fr)'s status on Tuesday, 19-Aug-2025 22:30:44 JST Thib

     in reply to

     • Lars

     @koyax The CA cert Proxmox generates is missing a keyUsage property, which means libraries won't trust it even after adding it to my trust store :)

   • Embed this notice
     Lars (koyax@troet.cafe)'s status on Tuesday, 19-Aug-2025 22:30:45 JST Lars

     in reply to

     @thibaultamartin Not sure if it is really a bug. It's called "self singed certificate" because it signs itself without a ca.
     Maybe use acme to create a let's encrypt one 🤓.

     Edit: Happy self hosting!

   • Embed this notice
     Mauricio Teixeira 🇧🇷🇺🇲 (badnetmask@hachyderm.io)'s status on Wednesday, 20-Aug-2025 00:35:15 JST Mauricio Teixeira 🇧🇷🇺🇲

     in reply to

     • Lars

     @thibaultamartin @koyax @mmeier
     Then in this case you would be advocating for a fully insecure environment, which is bad PR.

   • Embed this notice
     Thib (thibaultamartin@mamot.fr)'s status on Wednesday, 20-Aug-2025 00:35:17 JST Thib

     in reply to

     • Mauricio Teixeira 🇧🇷🇺🇲
     • Lars

     @badnetmask @koyax @mmeier Wouldn’t they just not issue a certificate at all if that were the case?

   • Embed this notice
     Mauricio Teixeira 🇧🇷🇺🇲 (badnetmask@hachyderm.io)'s status on Wednesday, 20-Aug-2025 00:36:58 JST Mauricio Teixeira 🇧🇷🇺🇲

     in reply to

     • Lars

     @thibaultamartin @koyax @mmeier
     Then in this case you would be advocating for a fully insecure environment, which is bad PR. Having some encryption is better than no encryption at all.