Spice error unable connect to graphic server

[cvdveer]

Hello,

Can't connect to any of the Spice enabled windows guests.
I can see SSL warnings but I need some assistance resolving them. I suspect the expired certificate but since I didn't touch that configuration I expected it to work with regular proxmox updates.

Apr 22 18:27:37 sarah QEMU[6387]: kvm: warning: Spice: error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired
Apr 22 18:27:37 sarah QEMU[6387]: kvm: warning: Spice: red-stream.c:542:red_stream_ssl_accept: SSL_accept failed, error=1

Regards,

Christiaan

 

[Moayad]

Hello,

can you please try the `pvecm updatecerts --force ` command on your PVE

 

[jcheger]

Same problem for me. Regenerating the certificates did the trick, but all KVM machines must be fully stopped, and the restarted.

 

[Moayad]

Did you see anything interesting in the syslog?

 

[davlaw]

I'm getting

Mar 09 04:25:45 vlogic3 QEMU[2449776]: kvm: warning: Spice: error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired

I'm off to research updating certs, but noticed the comment above about the restarts

 

[davlaw]

Well here is what I have ended up with so far

pvecm updatecerts --force

Gives me the following

(re)generate node files
generate new node certificate
CA expires in less than 2 weeks, unable to generate certificate.

viewing ssl cert data shows vailid sine 2023-01-25 05:14:45 expires 2023-02-06 05:14:45

The CA cert shows an expiration of 2023-02-09

I'm unsure how to work around/fix the CA expires unable to generate certificate error. Maybe a reboot is in order?

 

[davlaw]

found this

https://forum.proxmox.com/threads/solved-pve-certificate-expires-in-more-than-2-years.79152/

while the certs are now have valid dates, spice still does not like them... so reboot vm in question and last resort the node. We will see

 

[davlaw]

found this

https://forum.proxmox.com/threads/solved-pve-certificate-expires-in-more-than-2-years.79152/

while the certs are now have valid dates, spice still does not like them... so reboot vm in question and last resort the node. We will see

we have a winner, as noted above restart of the vm in question was needed