SSL trusted certificates doesn't show up on GUI

[pardub]

Good morning,

I requested SSL certificates through ACME for non staging environment but the GUI still display the "non trusted certificates".

I used the documentation in https://pve.proxmox.com/pve-docs/pve-admin-guide.html#sysadmin_certificate_management

There are some outputs below to give you an overview :

oot@ns300000:~# pvenode acme account deactivate default
Renaming account file from '/etc/pve/priv/acme/default' to '/etc/pve/priv/acme/_deactivated_default_1'
Task OK
root@ns300000:~# cd /etc/pve/priv/acme/
total 2.0K
-rw------- 1 root www-data 4.5K Oct 14 09:04 _deactivated_default_0
-rw------- 1 root www-data 4.5K Oct 15 07:12 _deactivated_default_1
root@ns300000:/etc/pve/priv/acme# rm _deactivated_default_0 _deactivated_default_1
rm: remove regular file '_deactivated_default_0'? y
rm: remove regular file '_deactivated_default_1'? y
root@ns300000:/etc/pve/priv/acme# ll
total 0
root@ns300000:/etc/pve/priv/acme# pvenode acme account register default test8888@gmail.com
Directory endpoints:
0) Let's Encrypt V2 (https://acme-v02.api.letsencrypt.org/directory)
1) Let's Encrypt V2 Staging (https://acme-staging-v02.api.letsencrypt.org/directory)
2) Custom
Enter selection:
0

Attempting to fetch Terms of Service from 'https://acme-v02.api.letsencrypt.org/directory'..
Terms of Service: https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf
Do you agree to the above terms? [y|N]y

Attempting to register account with 'https://acme-v02.api.letsencrypt.org/directory'..
Generating ACME account key..
Registering ACME account..
Registration successful, account URL: 'https://acme-v02.api.letsencrypt.org/acme/acct/69423589'
Task OK
root@ns300000:/etc/pve/priv/acme# systemctl restart pveproxy

root@300000:~# pvenode acme account list
default
root@300000:~# systemctl restart pveproxy

Thank you

 

[fabian]

you still need to create a new certificate after registering with the production endpoint..

 

[pardub]

So,I have to proceed again the process in https://pve.proxmox.com/pve-docs/pve-admin-guide.html#sysadmin_certificate_management in the part called "Example: Sample pvenode invocation for using Let’s Encrypt certificates " ?

root@proxmox:~# pvenode acme account register default mail@example.invalid
Directory endpoints:
0) Let's Encrypt V2 (https://acme-v02.api.letsencrypt.org/directory)
1) Let's Encrypt V2 Staging (https://acme-staging-v02.api.letsencrypt.org/directory)
2) Custom
Enter selection:
1

Attempting to fetch Terms of Service from 'https://acme-staging-v02.api.letsencrypt.org/directory'..
Terms of Service: https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf
Do you agree to the above terms? [y|N]y

Attempting to register account with 'https://acme-staging-v02.api.letsencrypt.org/directory'..
Generating ACME account key..
Registering ACME account..
Registration successful, account URL: 'https://acme-staging-v02.api.letsencrypt.org/acme/acct/xxxxxxx'
Task OK
root@proxmox:~# pvenode acme account list
default
root@proxmox:~# pvenode config set --acme domains=example.invalid
root@proxmox:~# pvenode acme cert order
Loading ACME account details
Placing ACME order
Order URL: https://acme-staging-v02.api.letsencrypt.org/acme/order/xxxxxxxxxxxxxx

Getting authorization details from
'https://acme-staging-v02.api.letsencrypt.org/acme/authz/xxxxxxxxxxxxxxxxxxxxx-xxxxxxxxxxxxx-xxxxxxx'
... pending!
Setting up webserver
Triggering validation
Sleeping for 5 seconds
Status is 'valid'!

All domains validated!

Creating CSR
Finalizing order
Checking order status
valid!

Downloading certificate
Setting pveproxy certificate and key
Restarting pveproxy
Task OK

 

[fabian]

no. you just registered with the staging endpoint again, and then requested a certificate. if you want a certificate from the production endpoint, you need to have and use an account there, and then request a certificate.

 

[pardub]

When you say "you need to have and use an account there, " which account are you referring to?

 

[fabian]

an account with Let's Encrypt? just do the steps to switch to the trusted/production directory as given in the documentation, and then order a certificate (using the GUI, or using 'pvenode') without switching back to the untrusted/staging directory.

 

[pardub]

Thank you.