Mismatching pve-ssl.pem certificate after hostname change - Correct process for renaming and changing the IP address of hosts in a cluster?

myrmidon

New Member
Dec 11, 2024
3
2
1
Hi there,

I went through the process of renaming and changing the IP address of a few hosts within my 9-node proxmox cluster. I am using Proxmox VE 8.2.7 at present.

For each host I wanted to rename and change the IP address of, one by one I edited the following files to rename the host correctly:

/etc/hosts
/etc/hostname
/etc/postfix/main.cf


I also updated the /etc/network/interfaces file to point to the new IP address.

And updated the hostname in the /etc/pve/corosync.conf file and incremented the version number. No issues so far.

The next bit is where I'm uncertain. The process I followed was:

cd into the /etc/pve/nodes directory

1. Copy the entry for the current server I was updating (changing IP/hostname) and name it as the new node name, e.g. 'cp -R /etc/pve/nodes/pve-10-1u-dl60-03 /etc/pve/nodes/pve-13-1u-dl60-03'

2. Remove the old node entry, e.g. 'rm -rf /etc/pve/nodes/pve-10-1u-dl60-03/'

3. and then force update of certificate, 'pvecm updatecerts --force' - this is where it would thought it would regenerate the pve-ssl.pem certificate to match the new information in the files mentioned above.

4. and finally, a reboot.

However, I have ran into an issue where some of the hosts now have mismatching pve-ssl.pem certificate files, e.g. the certificate is still using the old hostname and ip address, which can be seen in the web UI under Node > System > Certificates:

1733911394141.png

As you can see above, the certificate for pve-13-1u-dl60-03 is showing the old hostname and IP address. Please can someone advise on the correct process for correcting this?

This hasn't occurred on all of the hosts I renamed, but it did on 50% of them. I was wondering if I missed a step or if I did something incorrectly (manually copying and removing the old named entry in /etc/pve/nodes ?)

I would be grateful of some guidance on how to best remedy this.
 
Last edited:
Just to note, I was able to resolve this issue.

First, I ran

pvecm updatecerts

This didn't seem to update the certificates on the nodes at all. Either way, I waited a couple of minutes, and then followed up with:

pvecm updatecerts --force

This immediately changed the certificates in the Web UI to use the new hostname and IP address. I followed this on the other two nodes with mismatching pve-ssl.pem certificates, and this was successful too.

Strangely, this did not work last time I tried it, so I'll chalk it up to user error on my behalf.
 
Last edited:
  • Like
Reactions: reinob and anutrix
Just to note, I was able to resolve this issue.

First, I ran

pvecm updatecerts

This didn't seem to update the certificates on the nodes at all. Either way, I waited a couple of minutes, and then followed up with:

pvecm updatecerts --force

This immediately changed the certificates in the Web UI to use the new hostname and IP address. I followed this on the other two nodes with mismatching pve-ssl.pem certificates, and this was successful too.

Strangely, this did not work last time I tried it, so I'll chalk it up to user error on my behalf.
pvecm updatecerts --force worked for me too. Thanks.
 
Annoyingly this isn't working on one of my nodes. The other one updated fine with --force and shows nodename.home which is what I've changed it to, but the other one still shows nodename.pbs.localdomain even though I've changed it to .home in the three files (I'm not using clustering so there's no corosync.conf file).