Mismatching pve-ssl.pem certificate after hostname change - Correct process for renaming and changing the IP address of hosts in a cluster?

myrmidon

New Member
Dec 11, 2024
3
2
1
Hi there,

I went through the process of renaming and changing the IP address of a few hosts within my 9-node proxmox cluster. I am using Proxmox VE 8.2.7 at present.

For each host I wanted to rename and change the IP address of, one by one I edited the following files to rename the host correctly:

/etc/hosts
/etc/hostname
/etc/postfix/main.cf


I also updated the /etc/network/interfaces file to point to the new IP address.

And updated the hostname in the /etc/pve/corosync.conf file and incremented the version number. No issues so far.

The next bit is where I'm uncertain. The process I followed was:

cd into the /etc/pve/nodes directory

1. Copy the entry for the current server I was updating (changing IP/hostname) and name it as the new node name, e.g. 'cp -R /etc/pve/nodes/pve-10-1u-dl60-03 /etc/pve/nodes/pve-13-1u-dl60-03'

2. Remove the old node entry, e.g. 'rm -rf /etc/pve/nodes/pve-10-1u-dl60-03/'

3. and then force update of certificate, 'pvecm updatecerts --force' - this is where it would thought it would regenerate the pve-ssl.pem certificate to match the new information in the files mentioned above.

4. and finally, a reboot.

However, I have ran into an issue where some of the hosts now have mismatching pve-ssl.pem certificate files, e.g. the certificate is still using the old hostname and ip address, which can be seen in the web UI under Node > System > Certificates:

1733911394141.png

As you can see above, the certificate for pve-13-1u-dl60-03 is showing the old hostname and IP address. Please can someone advise on the correct process for correcting this?

This hasn't occurred on all of the hosts I renamed, but it did on 50% of them. I was wondering if I missed a step or if I did something incorrectly (manually copying and removing the old named entry in /etc/pve/nodes ?)

I would be grateful of some guidance on how to best remedy this.
 
Last edited:
Just to note, I was able to resolve this issue.

First, I ran

pvecm updatecerts

This didn't seem to update the certificates on the nodes at all. Either way, I waited a couple of minutes, and then followed up with:

pvecm updatecerts --force

This immediately changed the certificates in the Web UI to use the new hostname and IP address. I followed this on the other two nodes with mismatching pve-ssl.pem certificates, and this was successful too.

Strangely, this did not work last time I tried it, so I'll chalk it up to user error on my behalf.
 
Last edited:
  • Like
Reactions: reinob and anutrix
Just to note, I was able to resolve this issue.

First, I ran

pvecm updatecerts

This didn't seem to update the certificates on the nodes at all. Either way, I waited a couple of minutes, and then followed up with:

pvecm updatecerts --force

This immediately changed the certificates in the Web UI to use the new hostname and IP address. I followed this on the other two nodes with mismatching pve-ssl.pem certificates, and this was successful too.

Strangely, this did not work last time I tried it, so I'll chalk it up to user error on my behalf.
pvecm updatecerts --force worked for me too. Thanks.