Custom certificate (PEM) with comments or key (PEM) with a section EC PARAMETERS fail to upload

[sthielo]

Hi

we are currently testing PMG (no-subscription):

installing custom certificates (on PMG for for API) using pmgsh create /nodes/<node>/certificates/custom/api --certificates "$(cat $chain)" --key "$(cat $key)" --restart 1 --force failed when

• certificate chain file contained comment lines (starting with #) outside the CERTIFICATE sections OR
• key files contained a EC PARAMETERS section

when manually removing these (editing the files), the cert upload works smoothly.

That is how we get these files delivered. Otherwise we have to manipulate the files before installing them on PMG.

openssl accepts (ignores) these contents. That is another reason why we believe these content to be 'legal'/standard.

Is this a bug? Do we have to expect similar issues when deploying certs to our PVEs and POM (enterprise edition, but yet no public certs)

 

[fabian]

could you post a sample certificate (feel free to censor the actual certificate data)?
please also post "pmgversion --verbose" output.

 

[sthielo]

pmversion out:

proxmox-mailgateway-container: 9.1 (API: 9.1.4/9931cdff460a, running kernel: 7.0.14-26-pve)
pmg-api: 9.1.4
pmg-gui: 5.2.3
clamav-daemon: 1.4.6+dfsg-1~deb13u1+pmg1
ifupdown2: 3.3.0-1+pmx12
libarchive-perl: 3.7.4.1
libjs-extjs: 7.0.0-9
libproxmox-acme-perl: 1.7.2
libproxmox-acme-plugins: 1.7.2
libpve-apiclient-perl: 3.4.3
libpve-common-perl: 9.2.4
libpve-http-server-perl: 6.0.5
libxdgmime-perl: 1.2.0
lvm2: not correctly installed
pmg-docs: 9.1.1
pmg-i18n: 3.11.0
pmg-log-tracker: 3.1.2
pmg-mobile-quarantine-ui: 0.5.3
proxmox-mini-journalreader: 1.7
proxmox-spamassassin: 4.0.2-2
proxmox-widget-toolkit: 5.2.10
pve-xtermjs: 6.0.0-3

cert-chain with comment lines - just removing the comment lines makes the upload work:

#subject=CN=<readable cert info>
#issuer=C=BE, O=GlobalSign nv-sa, CN=GlobalSign GCC R6 AlphaSSL CA 2025
#notBefore=Mar  3 19:41:47 2026 GMT
#notAfter=Apr  4 19:41:46 2027 GMT
-----BEGIN CERTIFICATE-----
<cert content>
-----END CERTIFICATE-----
#subject=C=BE, O=GlobalSign nv-sa, CN=GlobalSign GCC R6 AlphaSSL CA 2025
#issuer=OU=GlobalSign Root CA - R6, O=GlobalSign, CN=GlobalSign
#notBefore=May 21 02:36:52 2025 GMT
#notAfter=May 21 00:00:00 2027 GMT
-----BEGIN CERTIFICATE-----
<intermediate cert content>
-----END CERTIFICATE-----

key file with EC PARAMETERS section - it seems that they can be recreated from cert infos, so just removing that section makes the upload work:

-----BEGIN EC PARAMETERS-----
<ec parameters content>
-----END EC PARAMETERS-----
-----BEGIN EC PRIVATE KEY-----
<key content>
-----END EC PRIVATE KEY-----

output of pmgsh create /nodes/<node name>/certificates/custom/api --certificates chain.crt --key cert.key --restart 1 --force with the contents as shown above:

400 Parameter verification failed.
certificates: invalid format - not a valid PEM-formatted string.

key: invalid format - not a valid PEM-formatted string.

output with the contents 'manipulated' - removed comment lines in chain file and removed EC PARAMETERS section in key file:

Setting custom certificate file /etc/pmg/pmg-api.pem
Restarting pmgproxy
200 OK
{
   "filename" : "pmg-api.pem",
   "fingerprint" : "<fingerprint>",
   "issuer" : "/C=BE/O=GlobalSign nv-sa/CN=GlobalSign GCC R6 AlphaSSL CA 2025",
   "notafter" : 1806867706,
   "notbefore" : 1772566907,
   "pem" : "-----BEGIN CERTIFICATE-----\n<cert content>\n-----END CERTIFICATE-----\n",
   "public-key-bits" : 384,
   "public-key-type" : "id-ecPublicKey",
   "san" : [ <alternative names> ],
   "subject" : "/CN=<subject>"
}

 

[fabian]

the cert part should be fixed in libpve-common-perl >= 9.2.8, not sure if the EC parameters one is also handled by that though..