Server always wants a different fingerprint

S

sukerman

Well-Known Member
Aug 29, 2019
57
7
48
52
I have 1 proxmox backup server fingerprint ED:ED:xxx etc. 5 of my servers have no problem with this but one of them is insisting that a different key is needed.

Code: 
vzdump backup status (elvis.xxxx.xxx) : backup failed: could not activate storage 'datastore-elvis': datastore-elvis: error fetching datastores - fingerprint 'C0:0E:19:63:49:53:xxxxxx' not verified, abort!

If I go into that server, change it to what it thinks the fingerprint should be C0:0E:xxxx etc. I can then click backup and it will work. But the next day it will start failing again insisting that another new key is needed, even though the fingerprint on the backup server hasn't changed.

I have deleted the storage and re-added it several times but I can only do it if I use the key it suggests, not the actual key on the backup box.

Any ideas please?
 
Last edited:
is there some reverse proxy (or similar) in between the node and the pbs?
 
No proxy or dns issues that I know of. Its very odd, the backup works if I use the wrong key and arrives on the backup server.
 
no need, i believe you ;)

can you post the output of

Code: 
curl -k -vvv https://your-pbs-hostname-or-ip:8007
from both a working and the broken node ?
 
dcsapak said:
no need, i believe you ;)

can you post the output of

Code: 
curl -k -vvv https://your-pbs-hostname-or-ip:8007
from both a working and the broken node ?
Click to expand...
Working:

Code: 
root@titan:~# curl -k -vvv https://backup.xxxx.xxxx:8007
*   Trying 51.xxx.xxx.8:8007...
* Connected to backup.xxxx.xxxx (51.xxx.xxx.8) port 8007 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: CN=backup.xxxx.xxxx
*  start date: Jun 15 02:04:24 2022 GMT
*  expire date: Sep 13 02:04:23 2022 GMT
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.
> GET / HTTP/1.1
> Host: backup.xxxx.xxxx:8007
> User-Agent: curl/7.74.0
> Accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< content-type: text/html
< content-length: 1938
< date: Fri, 17 Jun 2022 09:32:00 GMT
<
<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
    <title>backup - Proxmox Backup Server</title>
    <link rel="icon" sizes="128x128" href="/images/logo-128.png" />
    <link rel="apple-touch-icon" sizes="128x128" href="/pve2/images/logo-128.png" />
    <link rel="stylesheet" type="text/css" href="/extjs/theme-crisp/resources/theme-crisp-all.css" />
    <link rel="stylesheet" type="text/css" href="/extjs/crisp/resources/charts-all.css" />
    <link rel="stylesheet" type="text/css" href="/fontawesome/css/font-awesome.css" />
    <link rel="stylesheet" type="text/css" href="/widgettoolkit/css/ext6-pmx.css" />
    <link rel="stylesheet" type="text/css" href="/css/ext6-pbs.css" />

    <script type='text/javascript'> function gettext(buf) { return buf; } </script>


    <script type="text/javascript" src="/extjs/ext-all.js"></script>
    <script type="text/javascript" src="/extjs/charts.js"></script>

    <script type="text/javascript">
    Proxmox = {
    Setup: { auth_cookie_name: 'PBSAuthCookie' },
    NodeName: "backup",
    UserName: "",
    CSRFPreventionToken: "",
    };
    </script>
    <script type="text/javascript" src="/widgettoolkit/proxmoxlib.js"></script>
    <script type="text/javascript" src="/extjs/locale/locale-en.js"></script>
    <script type="text/javascript">
      Ext.History.fieldid = 'x-history-field';
    </script>
    <script type="text/javascript" src="/qrcodejs/qrcode.min.js"></script>
    <script type="text/javascript" src="/js/proxmox-backup-gui.js"></script>
  </head>
  <body>
    <!-- Fields required for history management -->
    <form id="history-form" class="x-hidden">
      <input type="hidden" id="x-history-field"/>
    </form>
  </body>
</html>
* Connection #0 to host backup.miappi.net left intact
root@titan:~#

Working since yesterday but with the wrong key:

Code: 
Last login: Tue May 31 08:18:43 2022

G   __
\\  ,,)_
 \'-\( /
   \ | ,\
    \|_/\\
    / _ '.D
   / / \ |
  /_\  |_\
  '-    '-

 09:33:55 up 32 days, 39 min,  2 users,  load average: 0.31, 1.51, 3.16
root@elvis:~# curl -k -vvv https://backup.xxx.xxx:8007
*   Trying 51.xxx.xxx.8:8007...
* Connected to backup.xxx.xxx (51.xxx.xxx.8) port 8007 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: CN=backup.xxx.xxx
*  start date: Jun 15 02:04:24 2022 GMT
*  expire date: Sep 13 02:04:23 2022 GMT
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.
> GET / HTTP/1.1
> Host: backup.xxx.xxx:8007
> User-Agent: curl/7.74.0
> Accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< content-type: text/html
< content-length: 1938
< date: Fri, 17 Jun 2022 09:33:58 GMT
<
<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
    <title>backup - Proxmox Backup Server</title>
    <link rel="icon" sizes="128x128" href="/images/logo-128.png" />
    <link rel="apple-touch-icon" sizes="128x128" href="/pve2/images/logo-128.png" />
    <link rel="stylesheet" type="text/css" href="/extjs/theme-crisp/resources/theme-crisp-all.css" />
    <link rel="stylesheet" type="text/css" href="/extjs/crisp/resources/charts-all.css" />
    <link rel="stylesheet" type="text/css" href="/fontawesome/css/font-awesome.css" />
    <link rel="stylesheet" type="text/css" href="/widgettoolkit/css/ext6-pmx.css" />
    <link rel="stylesheet" type="text/css" href="/css/ext6-pbs.css" />

    <script type='text/javascript'> function gettext(buf) { return buf; } </script>


    <script type="text/javascript" src="/extjs/ext-all.js"></script>
    <script type="text/javascript" src="/extjs/charts.js"></script>

    <script type="text/javascript">
    Proxmox = {
    Setup: { auth_cookie_name: 'PBSAuthCookie' },
    NodeName: "backup",
    UserName: "",
    CSRFPreventionToken: "",
    };
    </script>
    <script type="text/javascript" src="/widgettoolkit/proxmoxlib.js"></script>
    <script type="text/javascript" src="/extjs/locale/locale-en.js"></script>
    <script type="text/javascript">
      Ext.History.fieldid = 'x-history-field';
    </script>
    <script type="text/javascript" src="/qrcodejs/qrcode.min.js"></script>
    <script type="text/javascript" src="/js/proxmox-backup-gui.js"></script>
  </head>
  <body>
    <!-- Fields required for history management -->
    <form id="history-form" class="x-hidden">
      <input type="hidden" id="x-history-field"/>
    </form>
  </body>
</html>
* Connection #0 to host backup.xxxx.xxxx left intact
root@elvis:~#
 
can it be that it's just your lets encrypt cert changing?
you can also remove the fingerprint from the storage config entirely if the ssl cert ist trusted (which is the case for letsencrypt)
 
dcsapak said:
can it be that it's just your lets encrypt cert changing?
you can also remove the fingerprint from the storage config entirely if the ssl cert ist trusted (which is the case for letsencrypt)
Click to expand...
I don't know. Do I mis-understand something here? I thought when adding storage I have to enter the fingerprint of the destination server?
 
sukerman said:
I don't know. Do I mis-understand something here? I thought when adding storage I have to enter the fingerprint of the destination server?
Click to expand...
Actually - I think you must be right - its the letsencrypt cert changing - and thats the fingerprint its checking against, not the fingerprint reported by the backup server.

My confusion here was that on pve hosts and have pvb installed on the same machine the fingerprint always matched, but did change every 3 months which makes sense thats the cert renewing.

Thanks
 
Last edited:
You must log in or register to reply here.

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Quick Navigation

Home Get Subscription Wiki Downloads Proxmox Customer Portal About

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!
Community platform by XenForo® © 2010-2024 XenForo Ltd.
Top Bottom