[SOLVED] Error by Proxmox-backup-client when trying to backup to new PBS

[SpinningRust]

Hello everyone,

the other day I had to reinstall my Proxmox backup server. The only thing I migrated from the old installation to the new one is the datastore.cfg file. VM and CT Backups work Fine, but this morning my scripts for backing up data in my ZFS storage pool threw an error that I can’t seem to understand:
Run pbs backup for tank/data ... Error: error trying to connect: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:../ssl/statem/statem_clnt.c:1915:

The only other thread I found that mentions this error seems to be a self compiled binary on a CentOS machine, which is far away from my environment. I‘m trying to backup data from a normally installed PVE 6.4-5 to a basically freshly installed PBS 1.1-5.

The fingerprints in the storage.conf on PVE and the PBS Fingerprint Match, as I had to re-add it to the storage configuration on the PVE server.

I’d be very grateful for any ideas and/or comments.

Thanks in advance

John Tanner

 

[dcsapak]

if the pbs does not have a 'valid' certificate, you have to specify the fingerprint, see https://pbs.proxmox.com/docs/backup-client.html?highlight=pbs_fingerprint

 

[SpinningRust]

if the pbs does not have a 'valid' certificate, you have to specify the fingerprint, see https://pbs.proxmox.com/docs/backup-client.html?highlight=pbs_fingerprint

Hey dcsapak,
Thanks for the fast reply!

i tried it and yes, that indeed fixes the problem.
However, I’m wondering why I now suddenly need the fingerprint in the script because this wasn’t necessary before the reinstall. Could you maybe explain that?
Thanks again for the solution!

 

[dcsapak]

did the pbs server have 'valid' certificate before? did you maybe import the ca or certificate into the pve certificate store?
did you maybe read the fingerprint in the scrip before?

 

[SpinningRust]

did the pbs server have 'valid' certificate before? did you maybe import the ca or certificate into the pve certificate store?
did you maybe read the fingerprint in the scrip before?

No, not really
I just used the API key for verification and did nothing else with any certificates. And I just assumed the validity of the PBS certs because I didn’t change them and they were renewed during the install (obviously)
The fingerprint was also only ever saved in the storage.conf file, that’s why I’m a bit confused about this…

 

[dcsapak]

oh maybe the script ran shortly after a backup triggered on pve ? we cache the fingerprint in ~/.cache/proxmox-backup