is it safe to remove PBS from datacenter and add it again?

[Serg222]

Hi, we have PBS 2.0 at PVE 7.0
I want to remove PBS and re-join it to datacenter after PBS cert change, can you confirm all backups will be available after PBS re-join?

 

[Chris]

Hi, we have PBS 2.0 at PVE 7.0
I want to remove PBS and re-join it to datacenter after PBS cert change, can you confirm all backups will be available after PBS re-join?

Hi,
there is no need to remove the PBS as storage from PVE just for a certificate change. In case of self-signed certificates, just update the fingerprint after the change on PVE side.

On a side note: PBS 2.0 and PVE 7.0 are end of life, you should upgrade to the latest available versions as soon as possible, since you do not get any security updates and bugfixes with the currently running versions.

 

[Serg222]

Hi,
there is no need to remove the PBS as storage from PVE just for a certificate change. In case of self-signed certificates, just update the fingerprint after the change on PVE side.

On a side note: PBS 2.0 and PVE 7.0 are end of life, you should upgrade to the latest available versions as soon as possible, since you do not get any security updates and bugfixes with the currently running versions.

Yes, I have tried to change only cert like this:

root@pbs:~# cat proxy.pem > /etc/proxmox-backup/proxy.pem
root@pbs:~# cat proxy.key > /etc/proxmox-backup/proxy.key
root@pbs:~# systemctl reload proxmox-backup-proxy

got fingerprint error, change fingerprint to new one, but after this got new error:

proxmox-backup-client failed: Error: error trying to connect: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:../ssl/statem/statem_clnt.c:1914: (500)

 

[Chris]

Yes, I have tried to change only cert like this:


got fingerprint error, change fingerprint to new one, but after this got new error:

Is the certificate valid for the domains and ips of your PBS host? Also, I would recommend to upload custom certificates via the PBS WebUI, go to Certificates -> Upload Custom Certificate, there you will also see for which domains/IPs the certificate is issued.

 

[niteshadow]

Had the same issue, after I changed the PBS certificates, PBS fingerprint had changed.
Solution was to remove fingerprint in PVE | Storage, it's not needed with proper certificates.
Also make sure FQDN of the PBS is resolved properly, from the PVE.
You can check using openssl from PVE:

root@pve:~# openssl s_client -connect pbs.domain.com:8007 2>/dev/null | openssl x509 -noout -dates

Should show valid certificate dates:
notBefore=Jun 20 14:54:01 2023 GMT notAfter=Sep 18 14:54:00 2023 GMT