[SOLVED] SSL Certificate still not recognised after pvecm updatecerts --force

jekkelock

New Member
Jun 4, 2026
3
0
1
Im running on prox mox 4.2-5, When I tried to boot a VM I had offline it started throwing an error
Failed to start VNC server: The server certificate /etc/pve/local/pve-ssl.pem has expired

I run
pvecm updatecerts -f
and
systemctl restart pveproxy pvedaemon

when I refreshed the web insterface and checked the certificate validity it was changed saying it was issued today and expiring in 10 years time

after that I noticed a VM I had online had shut off (idk how thats possible), but thankfully the one VM i cant risk shutting down was online

After trying to start my VMs again I recieved the same error
[ERROR BELOW]

Proxmox Virtual Environment 4.2-5/7cf09667

Virtual Machine 102 ('docker-ubuntu' ) on node 'bdproxmox'

Running as unit 102.scope.
kvm: -vnc unix:/var/run/qemu-server/102.vnc,x509,password: Failed to start VNC server: The CA certificate /etc/pve/pve-root-ca.pem has expired
TASK ERROR: start failed: command '/usr/bin/systemd-run --scope --slice qemu --unit 102 --description \''Proxmox VE VM 102'\' -p 'KillMode=none' -p 'CPUShares=1000' /usr/bin/kvm -id 102 -chardev 'socket,id=qmp,path=/var/run/qemu-server/102.qmp,server,nowait' -mon 'chardev=qmp,mode=control' -pidfile /var/run/qemu-server/102.pid -daemonize -smbios 'type=1,uuid=04fd4724-80cd-4ba0-986a-c4ae02e49eee' -name docker-ubuntu -smp '2,sockets=1,cores=2,maxcpus=2' -nodefaults -boot 'menu=on,strict=on,reboot-timeout=1000' -vga cirrus -vnc unix:/var/run/qemu-server/102.vnc,x509,password -cpu kvm64,+lahf_lm,+sep,+kvm_pv_unhalt,+kvm_pv_eoi,enforce -m 4096 -k en-us -device 'pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f' -device 'pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e' -device 'piix3-usb-uhci,id=uhci,bus=pci.0,addr=0x1.0x2' -device 'usb-tablet,id=tablet,bus=uhci.0,port=1' -device 'virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3' -iscsi 'initiator-name=iqn.1993-08.org.debian:01:59be9bced26' -drive 'file=/dev/pve/vm-102-disk-1,if=none,id=drive-ide0,format=raw,cache=none,aio=native,detect-zeroes=on' -device 'ide-hd,bus=ide.0,unit=0,drive=drive-ide0,id=ide0,bootindex=100' -drive 'file=/var/lib/vz/template/iso/ubuntu-24.04.2-live-server-amd64.iso,if=none,id=drive-ide2,media=cdrom,aio=threads' -device 'ide-cd,bus=ide.1,unit=0,drive=drive-ide2,id=ide2,bootindex=200' -netdev 'type=tap,id=net0,ifname=tap102i0,script=/var/lib/qemu-server/pve-bridge,downscript=/var/lib/qemu-server/pve-bridgedown' -device 'e1000,mac=62:31:65:33:66:33,netdev=net0,bus=pci.0,addr=0x12,id=net0,bootindex=300'' failed: exit code 1.

------------------------------------------------------

Any tips from the community?
 
Last edited:
Update:
I just checked the certificates and only /pve-ssl.pem was fixed using pvecm updatecerts -f, pve-root-ca.pem is still expired, any clues on how to renew it as well, preferably without shutting down VMs
 
remove the root certificate file, then run "pvecm updatecerts -f" on each node in turn.