syslog spam unexpected SAN type encountered: 0

[David Harvey]

One of the nodes in my cluster (5.4) has recently started spamming daemon.log and syslog with
"unexpected SAN type encountered: 0"
I updated the certs for the pveproxy several weeks ago across the 4 nodes, which worked, certs accepted, in date etc, but then today the spam commenced on a node.
I see the error originated from: /usr/share/perl5/PVE/Certificate.pm But I've been unable to work out why it's suddenly sad. I'm also hesitant to restart pveproxy on my other nodes in case they decide they no longer like the certs.

I've tried using a cert from a working node - which as expected had a hostname mismatch/not trusted, but also resulted in the SAN error.

Any ideas?

 

[Alwin]

What does the following command show (or pve-proxy.pem)?

 openssl x509 -in /etc/pve/local/pve-ssl.pem -noout -text -pubkey

It will print also the public key, if you don't want to post it publicly, you can also send me a PM.

EDIT: And are there differences, when you compare them? Did the one node receive package updates?

 

[David Harvey]

Superstar:

139674975354944:error:0906D06CEM routinesEM_read_bio:no start line:../crypto/pem/pem_lib.c:686:Expecting: TRUSTED CERTIFICATE
for
/etc/pve/local/pve-ssl.pem

I had only been monkeying with the per node ones pveproxy-ssl.pem which gives good/sane output from your openssl command.
So clearly the pve-ssl.pem is sad! And as expected, the other nodes have apparently sane but out of date pve-ssl.pem files.

As I'm using pveproxy-ssl certs do we even need the pve-ssl ones anymore? It looks from my other nodes like pve-ssl ones were in fact the old expired certs I'd just replaced with fresh pveproxy-ssl ones. So it seems I got myself in quite the mess with certs.

Many thanks for your swift response!

 

[Alwin]

139674975354944:error:0906D06CEM routinesEM_read_bio:no start line:../crypto/pem/pem_lib.c:686:Expecting: TRUSTED CERTIFICATE
for
/etc/pve/local/pve-ssl.pem

That doesn't look good indeed.

As I'm using pveproxy-ssl certs do we even need the pve-ssl ones anymore?

The pveproxy-ssl overrides the pve-ssl, but you need to restart the pveproxy service to activate it.

See here for certificate managment.
https://pve.proxmox.com/pve-docs/pve-admin-guide.html#sysadmin_certificate_management