[SOLVED] Failing connection to pbs after setting a custom certificate in it.

[resoli]

PS: Maybe is worthwhile to open an issue for this?

Opened https://bugzilla.proxmox.com/show_bug.cgi?id=4207

 

[resoli]

Problem resolved, I report here my comment 2 in bug 4207:

Thanks! I installed only the leaf (the pbs server cert) and it works.

After that, i installed on pbs the complete chain (so the web gui is accessible without ssl exceptions). In order to let pve nodes to validate the chain, i installed the root ca (in PEM format) in /usr/local/share/ca-certificates/ on each pve node, running update-ca-certificate afterwards, so that our root being accepted by the system as a trusted one.

Problem resolved. Maybe the custom root should be part of the pve cluster fs, in order to propagate it cluster-wide, as other configuration?

Alternatively, maybe adding the fingerprint should work even for non self-signed custom certs?

Thanks,
rob

 

[resoli]

Note that no fingerprint is needed in pbs storage config, if the root is trusted by pve host.