[SOLVED] Fresh VM do not start (pve certificate error)

[grobs]

Hi,

I created a new virtual machine (myvm1.mydomain.com) on a new physical proxmox 4 host (myhost.mydomain.com).
As I have a wildcard certificate for my domain (*.mydomain.com), I replaced /etc/pve/local/pve-ssl.pem with my wildcard certificate.

I then tried to start a VM and got this error message:

Running as unit 200.scope.
kvm: -vnc unix:/var/run/qemu-server/200.vnc,x509,password: Failed to start VNC server: Our own certificate /etc/pve/local/pve-ssl.pem failed validation against /etc/pve/pve-root-ca.pem: The certificate hasn't got a known issuer

Then I appended the complete ca chain to /etc/pve/pve-root-ca.pem
But now I get this message :

Running as unit 200.scope.
kvm: -vnc unix:/var/run/qemu-server/200.vnc,x509,password: Failed to start VNC server: The certificate /etc/pve/pve-root-ca.pem basic constraints do not show a CA

As a workaround, I ran "pvecm updatecerts -f" which regenerated /etc/pve/local/pve-ssl.pem and /etc/pve/local/pve-ssl.key but I'm currently stuck on using a self signed certificate whereas I own a real wildcard certificate.

What did I miss?

Thanks for reading (and for further replies)

 

[t.lamprecht]

Hi,

we have a guide for using trusted certificates, see https://pve.proxmox.com/wiki/HTTPSCertificateConfiguration#CAs_other_than_Let.27s_Encrypt

You did not changed the ones for the Webinterface but the ones securing PVEs internals that's the reason the VM couldn't start anymore.

 

[grobs]

15min response, this is called super rapid power
Thank you t.lamprecht, that's the info I was missing.