download.proxmox.com presents wrong certificate

[VA1DER]

When trying to set up https (to prevent certain types of supply chain hacks and attacks) for the Proxmox apt repository, it is impossible because download.proxmox.com presents a certificate for enterprise.proxmox.com. I see that you use letsencrypt for certificates, and it should be relatively easy to get the certificate issued for extra SANs. This would allow increased security for package distribution, in addition to the packages being signed by your key.

Thanks.

 

[leesteken]

This is known and on purpose. There are old threads about this. Proxmox does not believe this would increase security. Maybe you can find those threads using the search functionality of this forum?

 

[VA1DER]

Maybe you can find those threads using the search functionality of this forum?

When I see situations like this, I tend to believe the best. Meaning I tend to believe it a genuine oversight, rather than an intentional refusal to follow security best practices. So I don't tend to look for old discussions, I just report the issue.

 

[leesteken]

When I see situations like this, I tend to believe the best. Meaning I tend to believe it a genuine oversight, rather than an intentional refusal to follow security best practices. So I don't tend to look for old discussions, I just report the issue.

Proxmox staff has explained before why they won't use HTTPS for anything but the enterprise repository. I don't remember the details and maybe I'm mistaken about this. Please use the search or wait for another volunteer.

EDIT: Even with HTTPS people can know which packages you download due to their size and even with HTTP the downloads are checked for tampering with checksums.

 

[Johannes S]

One older thread on this:

Post in thread 'Bad certificate for https://download.proxmox.com/'

Apr 18, 2023

Hi,

please also be aware that our apt repos come signed with our GPG keys anyway, so realistically adding HTTPS on top of that does not provide much of a security benefit.

The reason we use it for the enterprise repos is that you need to authenticate yourself there to prove you have a valid subscription. HTTPS is used there to protect those credentials.

• sterzy

The basic argument of Proxmox developers is, that all their packages are signed with gpg anyhow thus https doesn't add additional security.

I'm not much of a security researcher so have no opinion on this. I still trust Proxmox developers enough, that it doesn't affect my usage of the repositories

And Proxmox isn't the only company/project who do this, best practices or not. Ubuntu for example do this the same, as seen in their documentation for their coming upstream release: https://manpages.ubuntu.com/manpages/resolute/man5/sources.list.5.html

My guess is that https (due to being encrypted) brings some additional load on the deployment infrastructure so the non-enterprise repositories (aka the ones who don't generate income) of Proxmox have http while paying customers can have https if they think this improves security.

Now ubuntu shouldn't have budget constraints but I can imagine that even at their scale https versus http can make a big difference. So while it's possible to use https for ubuntu the default is still http to save on computing resources.

So I don't tend to look for old discussions, I just report the issue.

For bug reports bugzilla.proxmox.com should be used, for security reports the procedure is outlined at https://pve.proxmox.com/wiki/Security_Reporting Basically they have a dedicated mail adress so a responsible disclosure process can be followed in case of a critical vulnerability in the code.

Regarding best practices: It's not always easy to find the right keywords, but imho it's still best practice to look up whether somebody reported something before.