qm remote-migrate: error "invalid authority"

[tb1402]

Hello to everyone,

I'm trying to migrate a VM using the remote migration feature, but it gives me the following error:

qm remote-migrate 104 107 apitoken='Authorization: PVEAPIToken=root@pam!tkn38685=<token>',host=fd00:4155:40::6,port=8006,fingerprint='<fingerprint>' --target-bridge=vmbr0 --target-storage=local
Establishing API connection with remote at 'fd00:4155:40::6'
2025-07-28 08:19:49 remote: started tunnel worker 'UPID:px-server:00017903:003AA32C:68871685:qmtunnel:107:root@pam!tkn38685:'
tunnel: Error: invalid authority
CMD websocket tunnel died: command 'proxmox-websocket-tunnel' failed: exit code 1

2025-07-28 08:19:49 tunnel still running - terminating now with SIGTERM
2025-07-28 08:19:50 ERROR: migration aborted (duration 00:00:01): can't open tunnel - malformed JSON string, neither tag, array, object, number, string or atom, at character offset 0 (before "(end of string)") at /usr/share/perl5/PVE/Tunnel.pm line 299.
migration aborted

These are the log entries from the target machine:

Jul 28 08:19:49 px-server pvedaemon[16358]: <root@pam!tkn38685> starting task UPID:px-server:00017903:003AA32C:68871685:qmtunnel:107:root@pam!tkn38685:
Jul 28 08:24:49 px-server pvedaemon[96515]: Failed to accept tunnel connection - got timeout
Jul 28 08:24:49 px-server pvedaemon[96515]: Removing tunnel socket..
Jul 28 08:24:49 px-server pvedaemon[96515]: Removing temporary VM config..
Jul 28 08:24:49 px-server pvedaemon[96515]: Exiting mtunnel
Jul 28 08:24:49 px-server pvedaemon[16358]: <root@pam!tkn38685> end task UPID:px-server:00017903:003AA32C:68871685:qmtunnel:107:root@pam!tkn38685: Exiting mtunnel

And here is the log from the source machine:

Jul 28 08:19:49 pmtc qm[3459981]: <root@pam> starting task UPID:pmtc:0034CB8E:AE706073:68871685:qmigrate:104:root@pam:
Jul 28 08:19:50 pmtc qm[3459982]: migration aborted
Jul 28 08:19:51 pmtc qm[3459981]: <root@pam> end task UPID:pmtc:0034CB8E:AE706073:68871685:qmigrate:104:root@pam: migration aborted

Both nodes use a custom certificate from a self-signed root CA for the API. The CA was installed on both systems using update-ca-certificates .
Edit: None of the nodes has firewall rules configured and they are both within the same network.

I would appreciate it, if you could help me with this problem. I've searched for the "invalid authority" error but didn't find anything useful.
If you need more information let me know!


Best regards,
Tobias

 

[tb1402]

Well, I figured it out myself. After lots of trial an error I replaced the IPv6 address in the migrate command with a newly assigned IPv4 address of the remote host and it worked on the first try.

I'm using both proxmox hosts in an "IPv6 mostly" environment without major issues for years. It would be nice to see some development on the websocket-tunnel to support IPv6 only or at least provide a more meaningful error message to the user.