Backup to PBS failed. SSL certs verify fail

[mailo95]

Hello all,

I'm trying to use PBS in LXC and everything is installed on top of Debian 12 LXC (installed proxmox-backup-server package) + NFS mount as datastore but after trying to backup from my PVE to PBS there is the error log:

()
INFO: starting new backup job: vzdump 103 --node pve --remove 0 --mode snapshot --notification-mode auto --notes-template '{{guestname}}' --storage pbs
INFO: Starting Backup of VM 103 (qemu)
INFO: Backup started at 2024-05-08 10:59:28
INFO: status = running
INFO: VM Name: pfSense
INFO: include disk 'scsi0' 'local-lvm:vm-103-disk-0' 30G
INFO: backup mode: snapshot
INFO: ionice priority: 7
INFO: creating Proxmox Backup Server archive 'vm/103/2024-05-08T07:59:28Z'
INFO: issuing guest-agent 'fs-freeze' command
INFO: issuing guest-agent 'fs-thaw' command
ERROR: VM 103 qmp command 'backup' failed - backup connect failed: command error: error trying to connect: error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:../ssl/statem/statem_clnt.c:1889:
INFO: aborting backup job
INFO: resuming VM again
ERROR: Backup of VM 103 failed - VM 103 qmp command 'backup' failed - backup connect failed: command error: error trying to connect: error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:../ssl/statem/statem_clnt.c:1889:
INFO: Failed at 2024-05-08 10:59:28
INFO: Backup job finished with errors
INFO: notified via target `mail-to-root`
TASK ERROR: job errors

I have same wildcard self-signed SSL certs installed on both machines. Also noticed that after attaching the PBS in PVE there is a question mark and can't determine the free space. For the backup new user was created on PBS with permissions only to the datastore used for backups.

 

[Folke]

Hi,
when configuring the PBS target in PVE, you can set a fingerprint that should be used to verify the certificate of PBS. You can get that fingerprint from the PBS dashboard. There should be a button in the summary pane that is called Show Fingerprint.

 

[mailo95]

Hi,
when configuring the PBS target in PVE, you can set a fingerprint that should be used to verify the certificate of PBS. You can get that fingerprint from the PBS dashboard. There should be a button in the summary pane that is called Show Fingerprint.

I already did that. If some details around my wildcard self-signed certs will help I can post some.

 

[fabian]

which version of the client are you using? there was a bug where self-signed chains didn't work.. https://bugzilla.proxmox.com/show_bug.cgi?id=5248

 

[mailo95]

which version of the client are you using? there was a bug where self-signed chains didn't work.. https://bugzilla.proxmox.com/show_bug.cgi?id=5248

My PBS is 3.2-2 and my PVE is 8.1.4

 

[fabian]

seems like the fix is not yet contained in the qemu library, you'll need to wait for an update!

 

[Unsubtle9244]

Had the same issue @mailo95 with my custom CA.
For me it helped to add the custom CA to trusted root certificates!

place the CA cert here:
/usr/local/share/ca-certificates/custom_ca.crt

execute:
update-ca-certificates

 

[dannyleeuk]

Had the same issue @mailo95 with my custom CA.
For me it helped to add the custom CA to trusted root certificates!

place the CA cert here:
/usr/local/share/ca-certificates/custom_ca.crt

execute:
update-ca-certificates

omg...thank you so much!! This was driving me mad!!

 

[caspar]

Had the same issue @mailo95 with my custom CA.
For me it helped to add the custom CA to trusted root certificates!

place the CA cert here:
/usr/local/share/ca-certificates/custom_ca.crt

execute:
update-ca-certificates

thanks a lot - that was it! drove me crazy...