Clean installation of 3.2 works but ssl / web interface is broken

rleckie

New Member
Jul 6, 2011
1
0
1
Provo, Utah, USA
We have had some unusually problems with our cluster lately, and decided to installed Proxmox 3.2. Since all our VM's are on our SAN we decided to do a clean installation from ISO. Downloaded and verified the MD5 and the burn. Installation worked fine. Rebooted. When the host came back up I had to add a VLAN and move the management interface over to it. Restarted the network to make sure that it was accessable. It was. For good measure I rebooted again and then tried to login via the web, but it never connects. SSH'ed into the host to determine if there were any problems.
Here is the output from pveversion -v
Code:
root@vm03:~# pveversion -v
proxmox-ve-2.6.32: 3.2-121 (running kernel: 2.6.32-27-pve)
pve-manager: 3.2-1 (running version: 3.2-1/1933730b)
pve-kernel-2.6.32-27-pve: 2.6.32-121
lvm2: 2.02.98-pve4
clvm: 2.02.98-pve4
corosync-pve: 1.4.5-1
openais-pve: 1.1.4-3
libqb0: 0.11.1-2
redhat-cluster-pve: 3.2.0-2
resource-agents-pve: 3.9.2-4
fence-agents-pve: 4.0.5-1
pve-cluster: 3.0-12
qemu-server: 3.1-15
pve-firmware: 1.1-2
libpve-common-perl: 3.0-14
libpve-access-control: 3.0-11
libpve-storage-perl: 3.0-19
pve-libspice-server1: 0.12.4-3
vncterm: 1.1-6
vzctl: 4.0-1pve4
vzprocps: 2.0.11-2
vzquota: 3.1-2
pve-qemu-kvm: 1.7-4
ksm-control-daemon: 1.1-1
glusterfs-client: 3.4.2-1
That seemed to be ok, so then I checked the logs. /var/log/messages seemed to be fine. But I found an interesting lines that keeps repeating in /var/log/daemon.log
Code:
Mar 20 14:48:12 vm03 pveproxy[3780]: worker 3781 finished
Mar 20 14:48:12 vm03 pveproxy[3780]: starting 1 worker(s)
Mar 20 14:48:12 vm03 pveproxy[3780]: worker 3844 started
Mar 20 14:48:12 vm03 pveproxy[3844]: /etc/pve/local/pve-ssl.pem: failed to use local certificate chain (cert_file or cert) at /usr/share/perl5/PVE/HTTPServer.pm line 1324
That led me to a post about the ssl keys not generating correctly. I found that you can force the certs to be updated. So I attempted a pvecm updatecerts --force
Code:
root@vm03:/var/log# pvecm updatecerts --force
problems making Certificate Request
140717792769704:error:0D07A097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:a_mbstr.c:154:maxsize=64
unable to generate pve certificate request:
command 'openssl req -batch -new -config /tmp/pvesslconf-5639.tmp -key /etc/pve/nodes/vm03/pve-ssl.key -out /tmp/pvecertreq-5639.tmp' failed: exit code 1
So something is wrong with the keys, which would explain why https isn't working properly, and hence I cannot get into the web interface. I have not run any commands to alter anything other than what is explained in this post. This is just a clean installation from the ISO. This is the first time that I have had any problems installing directly from the ISO.
Am I missing something? Anyone have any ideas of what else I can check?
thanks.
 
Hi,

Did you manage to fix this? I'm having this very problem in a new cluster member of a newly installed server.

# pveversion -v
proxmox-ve-2.6.32: 3.2-126 (running kernel: 2.6.32-29-pve)
pve-manager: 3.2-4 (running version: 3.2-4/e24a91c1)
pve-kernel-2.6.32-29-pve: 2.6.32-126
pve-kernel-2.6.32-26-pve: 2.6.32-114
lvm2: 2.02.98-pve4
clvm: 2.02.98-pve4
corosync-pve: 1.4.5-1
openais-pve: 1.1.4-3
libqb0: 0.11.1-2
redhat-cluster-pve: 3.2.0-2
resource-agents-pve: 3.9.2-4
fence-agents-pve: 4.0.5-1
pve-cluster: 3.0-12
qemu-server: 3.1-16
pve-firmware: 1.1-3
libpve-common-perl: 3.0-18
libpve-access-control: 3.0-11
libpve-storage-perl: 3.0-19
pve-libspice-server1: 0.12.4-3
vncterm: 1.1-6
vzctl: 4.0-1pve5
vzprocps: 2.0.11-2
vzquota: 3.1-2
pve-qemu-kvm: 1.7-8
ksm-control-daemon: 1.1-1
glusterfs-client: 3.4.2-1
 
Just sorted this out, the problem was with the certificate for pveproxy:

root@txoritokieta:/etc/pve/local# ls -l
total 2
drwxr-x--- 2 root www-data 0 jun 6 10:31 openvz
drwx------ 2 root www-data 0 jun 6 10:31 priv
-rw-r----- 1 root www-data 1679 jun 6 16:47 pve-ssl.key
-rw-r----- 1 root www-data 0 jun 6 10:31 pve-ssl.pem
drwxr-x--- 2 root www-data 0 jun 6 10:31 qemu-server

Our other cluster servers have a custom-CA signed crt, and it seems there was some kind of failure when joining the new node to the cluster. Our fix was:

1. Create a new key and certificate for this node
2. Replace pve-ssl.key and pve-ssl.crt in /etc/pve/local
3. service pve-manager restart

Error in syslog is gone and web interface works again.

Cheers
Eneko
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!