Renew SSL certificate after ip change of the GUI

C

chris_lee

Active Member
Dec 18, 2012
38
2
28
Dear colleagues,

I ran into a problem after I changed the IP of the GUI interface. The Web UI was still reachable, but when opening the VNC console, I got an a "failed to connect to server" error.
I moved the files:
  • /etc/pve/pve-root-ca.pem
  • /etc/pve/priv/pve-root-ca.key
somewhere else and did

pvecm updatecerts -f

Nevertheless safari did not open the noVNC console. Firefox allows it with some errors. When I display the certificate, that is served, I see still the old IP, which causes the certificate mismatch.

Is there an easy way of renewing the certificate. Any suggestions?

Thanks
Chris
 
did you also change the ip in /etc/hosts before you updated your certs ? (we resolve the hostname for checking its ip)
 
  • Like
Reactions: XGKCode and beatwin
Hello
I'm on Pve 7.1-7 currently, I encountered the same problem.
The pvecm updatecerts --force command does not seem to generate the pve-root.ca.pem file in this specific case.

You just have to delete it manually, then once the command has been launched, it is generated.
 
Sorry for updating a old thread but this was the top result to the issue I was having in a Google search.

Ran into this today and just updating the cert didn't work. This is what I found.

If pvecm updatests -f doesn't work and it still shows the old ip,
check
cat /etc/pve/.members | python3 -m json.tool

if you see the old ip in that list for one of the nodes

ssh into the node its wrong, then run
systemctl restart pve-cluster
sleep 5
systemctl is-active pve-cluster
cat /etc/pve/.members | python3 -m json.tool

It should update
Then repeat updating the cert

pvecm updatecerts --force
systemctl restart pveproxy pvedaemon pvestatd

Then validate

Hope this helps someone
 
Last edited:
You must log in or register to reply here.
Top Bottom
Back