Can I/Should I change the root CA cert?

[Jacob Sommerville]

So I followed the instructions here:
https://pve.proxmox.com/wiki/HTTPS_...4.x_and_newer)#CAs_other_than_Let.27s_Encrypt

But I'm using my own internal CA to generate certificates and am getting the error
"Failed to start VNC server: Our own certificate /etc/pve/local/pve-ssl.pem failed validation against /etc/pve/pve-root-ca.pem"

Do I need to replace the /etc/pve/pve-root-ca.pem with my own internal CA?

edit:

So I guess I fixed it myself. I just appended the pve-root-ca.pem with the cert from my own internal CA and restarted the pve proxy service. If that's was the right thing to do maybe it can get added to the wiki.

 

[fabian]

So I followed the instructions here:
https://pve.proxmox.com/wiki/HTTPS_...4.x_and_newer)#CAs_other_than_Let.27s_Encrypt

But I'm using my own internal CA to generate certificates and am getting the error
"Failed to start VNC server: Our own certificate /etc/pve/local/pve-ssl.pem failed validation against /etc/pve/pve-root-ca.pem"

Do I need to replace the /etc/pve/pve-root-ca.pem with my own internal CA?

edit:

So I guess I fixed it myself. I just appended the pve-root-ca.pem with the cert from my own internal CA and restarted the pve proxy service. If that's was the right thing to do maybe it can get added to the wiki.

you are doing exactly what the howto tells you NOT to do. please leave the internal cluster CA alone (see the first section of the howto on how to get back to the stock state), and put your key and chain into /etc/pve/local/pveproxy-ssl.key respectively /etc/pve/local/pveproxy-ssl.pem (on each node).

 

[Jacob Sommerville]

you are doing exactly what the howto tells you NOT to do. please leave the internal cluster CA alone (see the first section of the howto on how to get back to the stock state), and put your key and chain into /etc/pve/local/pveproxy-ssl.key respectively /etc/pve/local/pveproxy-ssl.pem (on each node).

OK, fair enough. I was just going by this:

"fullchain.pem (your certificate and all intermediate certificates, excluding the root certificate, in PEM format)"

So I should INCLUDE the root certificate in the fullchain? I did exactly what the wiki described by excluding it the first time and that's when I received the "Failed to start VNC server: Our own certificate /etc/pve/local/pve-ssl.pem failed validation against /etc/pve/pve-root-ca.pem" error.

 

[dcsapak]

the problem is you overwrote the pve-ssl.* files instead of creating the pveproxy-ssl.* files
the pve-ssl.* files will be used also for other things, besides the webinterface

edit: correct filename

 

[Jacob Sommerville]

the problem is you overwrote the pve-ssl.* files instead of creating the pveproxy-ssl.* files
the pve-ssl.* files will be used also for other things, besides the webinterface

edit: correct filename

You are 100% correct. Thank you. I made backups of the other keys just incase I screwed up. I restored the keys and certs and added the new key and pem as pveproxy-ssl.* respectively and everything seems to be working.