Fingerprint not verified - Abort

[cmurrayis]

Hi Everyone,

We've been running a pair of clustered PMG for a couple years now and it's always had issues with the fingerprints becoming invalid every few weeks.

Is there a fix or known cause to this as usually I just edit the cluster configuration file and put the new fingerprints in and off it goes again for a few more weeks

 

[Stoiko Ivanov]

We've been running a pair of clustered PMG for a couple years now and it's always had issues with the fingerprints becoming invalid every few weeks.

Is there a fix or known cause to this as usually I just edit the cluster configuration file and put the new fingerprints in and off it goes again for a few more weeks

Do you change your certificates that often?! - If yes - why?
If you have deployed some ACME certificate script (certbot, acme.sh,..) - this is expected - and you would just need to run
`pmgcm update-fingerprints` after getting the new certificate (or switch over to using the ACME implementation in the GUI/API, which does this for you):
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#sysadmin_certificate_management (section 4.6.8)

I hope this helps!

 

[cmurrayis]

Do you change your certificates that often?! - If yes - why?
If you have deployed some ACME certificate script (certbot, acme.sh,..) - this is expected - and you would just need to run
`pmgcm update-fingerprints` after getting the new certificate (or switch over to using the ACME implementation in the GUI/API, which does this for you):
https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#sysadmin_certificate_management (section 4.6.8)

I hope this helps!

We do use the ACME built in management - This happens more frequently than the 3 Month SSL renewal.

 

[Stoiko Ivanov]

This happens more frequently than the 3 Month SSL renewal.

The renewal happens when the current certificate is expiring in less than 30 days, which means it will be renewed every 2 months roughly

can you share the logs of the last time you ran into the issue - from both nodes, for at least one day (24h before, and 3h after the error occurs)?

 

[hk@]

Hi, we got the very same issue - after manually forcing update-fingerprints it works again, yet we too see this issue basically every two months.
Which logs would be required to get to you?