SSL certificate not valid.

[xiki]

Hi I'm following the docs but still I'm missing something. I manage to generate new certificates but when I try to reach my server, hosted locally in my LAN I still see "NET::ERR_CERT_COMMON_NAME_INVALID" on chrome, similar issues on other browsers.

This is what I am doing:

pvenode acme account register default <email>
pvenode acme plugin add dns godaddy-dns --api gd --data "/tmp/acme_keys"
pvenode config set --acmedomain0 <domain>,plugin=godaddy-dns
pvenode acme cert order
systemctl restart pveproxy

And this is the output:

root@pve:~# pvenode acme account register default <email>
Directory endpoints:
0) Let's Encrypt V2 (https://acme-v02.api.letsencrypt.org/directory)
1) Let's Encrypt V2 Staging (https://acme-staging-v02.api.letsencrypt.org/directory)
2) Custom
Enter selection: 0


Attempting to fetch Terms of Service from 'https://acme-v02.api.letsencrypt.org/directory'..
Terms of Service: https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf
Do you agree to the above terms? [y|N]: y


Attempting to register account with 'https://acme-v02.api.letsencrypt.org/directory'..
Generating ACME account key..
Registering ACME account..
Registration successful, account URL: 'https://acme-v02.api.letsencrypt.org/acme/acct/124385920'
Task OK
root@pve:~# pvenode acme plugin add dns godaddy-dns --api gd --data "/tmp/acme_keys"
root@pve:~# pvenode config set --acmedomain0 <domain>,plugin=godaddy-dns
root@pve:~# pvenode acme cert order
Loading ACME account details
Placing ACME order
Order URL: https://acme-v02.api.letsencrypt.org/acme/order/124385920/9855565849


Getting authorization details from 'https://acme-v02.api.letsencrypt.org/acme/authz-v3/13317026044'
The validation for <domain> is pending!
[Fri May 21 18:14:33 CEST 2021] Adding record
[Fri May 21 18:14:33 CEST 2021] Added, sleeping 10 seconds
Add TXT record: _acme-challenge.<domain>
Sleeping 30 seconds to wait for TXT record propagation
Triggering validation
Sleeping for 5 seconds
Status is still 'pending', trying again in 10 seconds
Status is still 'pending', trying again in 10 seconds
Status is 'valid', domain '<domain>' OK!
Remove TXT record: _acme-challenge.<domain>


All domains validated!


Creating CSR
Checking order status
Order is ready, finalizing order
valid!


Downloading certificate
Setting pveproxy certificate and key
Restarting pveproxy
Task OK
root@pve:~# systemctl restart pveproxy

The domain is a domain I own on GoDaddy, but I'm placing a prefix, which is not registered. So if my owned domain is example.com, I'm using abc.example.com. There is no A or CNAME records for this subdomain. Do I need to register something?

I can see the TXT record generated on my DNS Management panel, in GoDaddy after ordering the certificates.

Can someone tell me what I'm missing and how to be able to have a configured SSL certificate for my locally hosted proxmox server?

I am using Proxmox VE 6.4

Thank you!

 

[xiki]

Hmm.. ok I figured how to solve the warning, but I don't like the solution. What I did is to add an entry on my PC to /etc/hosts. So now the domain registered to create the certificate is equal to the one on my address bar - when I want to access Proxmox GUI ( not using IPORT anymore ).

But this does not work for what I want to achieve. I have an android app that needs to access some services running on the Proxmox server over HTTPS. So this solution is not a real fix for my implementation.

Can I solve this in any other way? Ideally with some configuration on Proxmox and not having to do any other configurations on other devices.

 

[mhakim]

still strugling with the ssl error, anyone can help?

 

[t.lamprecht]

This is still the default, self-signed certificate of Proxmox VE.

Either setup ACME/Let's Encrypt ( https://pve.proxmox.com/pve-docs/chapter-sysadmin.html#sysadmin_certs_get_trusted_acme_cert ), or add the cluster CA to your systems trust store, or upload an existing certificate for that host if you have already a valid one from a traditional provider.
I'd recommend ACME/Let's Encrypt

 

[mhakim]

thanks @t.lamprecht , it's working now.
i just do an order command via acme.

btw..
I still got certificate error on the vm, how can I do ssl for the vm hosts?