PDM TLS Certificate Cannot Be Replaced

[Johannes M.]

Hello,
I attempted to replace the default TLS certificate used by Proxmox Datacenter Manager (PDM) with a certificate issued by an internal CA. Even after replacing proxy.pem and proxy.key in /etc/proxmox-datacenter-manager/, updating permissions, restarting services, and killing the API processes, PDM continued to present the original self‑signed certificate generated on first startup.

PDM does not load TLS material from the filesystem, nor does it provide any CLI or API mechanism to import a custom certificate. The certificate appears to be stored internally and is not replaceable through documented means. As a result, administrators cannot deploy CA‑signed certificates for PDM, which limits integration into environments with strict PKI requirements.

Any Ideas how i can solve this?

Thanks in advance for any suggestion

 

[fabian]

https://pdm.proxmox.com/docs/sysadmin.html#upload-custom-certificate

 

[Keeper of the Keys]

Hey @fabian I manage my certs with ansible from a central location is there a way to allow this mode of management like on pve/pbs?

I don't really want separate acme.sh instances on each server at this time.

 

[fabian]

yes: https://pdm.proxmox.com/docs/api-viewer/index.html#/nodes/{node}/certificates/custom

 

[Keeper of the Keys]

So only API and no replaceable file?

 

[fabian]

you should use the API, yes. obviously that replaces a file (which you can do as well), but that is an implementation detail that I would not rely on long-term.