SPICE connection issue after cert issue

[dowdle]

Greetings,

I have a cluster with a few nodes. One of the nodes was accessible to the outside world so I decided to give Let's Encrypt a try within the PVE web interface... and successfully got it working with a LE cert my browsers liked. Then when it came time to renew I discovered that the powers-that-be had blocked outside access... and I had trouble renewing the cert... and just switched back to a self-signed one. I was inexperienced with such surgery and for a day or so had trouble accessing a node or two. Finally got that all sorted out... but an undesired side-effect remains:

While I can successfully login to all of the nodes and access them from the web interface, a few of them refuse to allow me to connect to my VMs with the SPICE protocol. Well, it is the spice client I'm running doesn't seem to like the cert the downloaded connection file provides. I've made sure the systems are all using NTP and the issue isn't caused by a timing/cert lifecycle issue.

I spent a while combing through the documentation and the forums, and while I've found a few issues/fixes for SPICE connection issues, none of them seemed to match up with the issue I'm having. Anyone have a clue on how to fix it?

I did investigate remote-viewer to see if maybe it'd have a flag to ignore the issue and just connect anyway... but there isn't much documentation related to the issue that I've been able to find.

HELP!

In the mean time, I can use noVNC but on some systems it takes a bit of mouse manipulation before I get a reasonable pointer... and I really miss SPICE.

TYL,
Scott Dowdle, Bozeman, Montana, USA

 

[dowdle]

I run the following command on all of my nodes:
$ openssl verify -CAfile /etc/pve/pve-root-ca.pem /etc/pve/local/pve-ssl.pem

They all return errors except for one node that is "OK". The OK node works. How do I fix the broken ones?

 

[dowdle]

I found one forum post (https://forum.proxmox.com/threads/lets-encrypt-on-a-multi-node-cluster.65356/) where a user had one working node and all of the others weren't... and Fabian said to run "pvecm updatecerts" on the node that was working. The user didn't actually try that an restored previous certs to fix it. My question is... is my working node the cause of the others failing... and will running "pvecm updatecerts" on the working node... make the others start working?

It would be nice to get a short explanation as to what that is doing and what the problem is and how it fixes it... if it isn't too complicated to write out. Thanks in advance.

 

[dowdle]

I found one forum post (https://forum.proxmox.com/threads/lets-encrypt-on-a-multi-node-cluster.65356/) where a user had one working node and all of the others weren't... and Fabian said to run "pvecm updatecerts" on the node that was working. The user didn't actually try that an restored previous certs to fix it. My question is... is my working node the cause of the others failing... and will running "pvecm updatecerts" on the working node... make the others start working?

It would be nice to get a short explanation as to what that is doing and what the problem is and how it fixes it... if it isn't too complicated to write out. Thanks in advance.

Well, I tried that... first on the working node... no change... then on multiple broken nodes... and no change. The working one is still working and the non-working ones are still not working.

 

[dowdle]

Well, I tried that... first on the working node... no change... then on multiple broken nodes... and no change. The working one is still working and the non-working ones are still not working.

ARGH. Now I can't connect to half of my nodes with the web interface because of cert errors. That's what I dislike, trying to improve something and only making it worse.

 

[dowdle]

Ok, restored all of the files back to what they were before I tried this fix... and at least I'm back to my previous state of breakage... with the web interface working for all nodes. Back to the drawing board.

ARGH. Now I can't connect to half of my nodes with the web interface because of cert errors. That's what I dislike, trying to improve something and only making it worse.

Ok, restored all of the files back to what they were before I tried this fix... and at least I'm back to my previous state of breakage... with the web interface working for all nodes. Back to the drawing board.

 

[dowdle]

I still haven't found a fix for this and continue to use noVNC.