[SOLVED] Disabling ssl on latest proxmox ve

[Temtaime]

Hello !
I tried to search and all the guides about how it have to be done seemed outdated.
Newer proxmox builds have other options regarding ssl.
I know what i am doing and i want to permanently disable ssl on web admin page, because:

• My installation already behind external firewall
• I want to use external proxy with cofingured ssl sertificates
• I don't want to create (self signed) sertificates for the pveproxy and update / maintain them

So please, how ssl can be disabled on pveproxy ?
Kind regards.

 

[fabian]

Hello !
I tried to search and all the guides about how it have to be done seemed outdated.
Newer proxmox builds have other options regarding ssl.
I know what i am doing and i want to permanently disable ssl on web admin page, because:

• My installation already behind external firewall

that is not really relevant, traffic should still be encrypted.

• I want to use external proxy with cofingured ssl sertificates

nothing stops you from doing that?

• I don't want to create (self signed) sertificates for the pveproxy and update / maintain them

PVE does it for you, no need to do anything manual (especially if you have a proxy in front anyway?).

So please, how ssl can be disabled on pveproxy ?

it's not possible.

 

[Temtaime]

Why it was possible time ago and is not possible now ?
I just want to disable it understanding all the risks.

 

[tom]

Why it was possible time ago and is not possible now ?
I just want to disable it understanding all the risks.

Proxmox VE is optimized for best security, so we do not implement http anymore.

 

[gallew]

Just a thought.
One option to achieve this is to use nginx as reverse proxy and serve http from nginx.
This also gives you an option to use fail-over solution when one node is not available you still connect to web ui by name, and reverse proxy takes data from second or third node.
And you can set to ignore ssl errors from downstream, therefore you can use self signed ssl certs.
Also you can use nginx to serve SSL, and in that case you always can connect to webui that has correct certificate regardless to what backend proxmox instance nginx proxy connects.

Since i have not tested this, there might be a problem with sessions (you'll have to log in again) where connection is made to second proxmox instance, and then, in the middle of session, first node becomes available.

upstream proxmox {
    server 10.0.0.1:8006;
    server 10.0.0.2:8006 backup;
    server 10.0.0.3:8006  backup;
}

...

location / {
    proxy_pass https://proxmox;
    proxy_ssl_verify off;
    proxy_next_upstream error http_502;
}

 

[Temtaime]

Got it
Thanks