get gpg key through trusted https

[aurelagep]

Hi,

Currently we cannot retrieve the gpg keys through trused https connection. It's an untrusted certificate.
Could you please improve this or give a way to safely get a GPG key ?

$ export LC_ALL=C ; wget https://download.proxmox.com/debian/proxmox-ve-release-6.x.gpg
--2019-09-24 15:53:24-- https://download.proxmox.com/debian/proxmox-ve-release-6.x.gpg
Loaded CA certificate '/etc/ssl/certs/ca-certificates.crt'
Resolving download.proxmox.com (download.proxmox.com)... 212.224.123.70, 2a01:7e0:0:424::249
Connecting to download.proxmox.com (download.proxmox.com)|212.224.123.70|:443... connected.
The certificate's owner does not match hostname 'download.proxmox.com'


Thanks
Regards,Aurelien

 

[RokaKen]

Use the --no-check-certificate argument to 'wget':

wget --no-check-certificate https://download.proxmox.com/debian/proxmox-ve-release-6.x.gpg

EDIT: The above will NOT work anyway as the HTTPS redirect currently does not have the key files

 

[aurelagep]

Hi,
The problem is that it's a workaround, the certificate should trusted otherwise it break the chain of trust ?

 

[RokaKen]

I understand and agree it would be better if they added a SAN to their server certificate for download.proxmox.com or a wildcard SAN with respect to automatically accepting the certificate. However, you have manually verified that you are connecting to the correct server and therefore trust the certificate enterprise.proxmox.com, so you can use the "workaround" for the application until the certificate is corrected.

EDIT:

However, I just checked and the HTTPS redirects to a DIFFERENT server/location. Thus, it appears currently the only way to retrieve the key is VIA HTTP -- not HTTPS (regardless of certificate SAN).

wget http://download.proxmox.com/debian/proxmox-ve-release-6.x.gpg

Perhaps a Proxmox admin will see this thread and add the key files to the secure location as well.

 

[aurelagep]

Thank you for your feedback, I didn't spot the redirection.
I think it's wise to push this to an admin in order increase the security concern.
Indeed the documentation only use http

 

[RokaKen]

@Stoiko Ivanov can you facilitate this request?

 

[aurelagep]

Hi all,
We are still following this thread with my team to implement this in our ansible playbook
I think other people are interested by this thread
Have a good day

 

[fabian]

https://git.proxmox.com/?p=proxmox-ve.git;a=tree;f=debian

https://pve.proxmox.com/pve-docs/pve-admin-guide.html#sysadmin_package_repositories
also contains the sha512 and md5 sum of the PVE 6.x key for additional verification.

 

[aurelagep]

Hi Fabian,
Thanks for your fast reply !
Interesting way to go. Let me implement something and I'll come back to you
Cheers,