Upload subscription key fails

[Yariv]

Hi,
When I try from CLI running pvesubscription set (using a proxy server) I get the below error:
WARN: Sending fatal alert BadCertificate
Error checking subscription: https://shop.proxmox.com/modules/servers/licensing/verify.php: Connection Failed: tls connection init failed: invalid peer certificate contents: invalid peer certificate: UnknownIssuer

Using GUI I get: Error checking subscription: https://shop.proxmox.com/modules/servers/licensing/verify.php: Connection Failed: tls connection init failed: invalid peer certificate contents: invalid peer certificate: UnknownIssuer (500)

What can be the issue?
Thanks,
Yariv

 

[aaron]

Can the host access the internet (https://shop.proxmox.com) directly, or is there something in the middle that intercepts the traffic with its own certificate?
If the issue persists, please open a ticket in our support portal at https://my.proxmox.com. There we can figure out what is interfering with the connection.

 

[Yariv]

Yes, it is going through a proxy server.

 

[Yariv]

Is there a curl command I can use to test this?

 

[aaron]

Well, if the proxy is intercepting the HTTPS traffic with its own cert, you either have to add it to the trust store of the hosts or add an exception on the proxy for the requests you see in the error message: https://shop.proxmox.com/modules/servers/licensing/verify.php

If you need further help, please open a ticket at https://my.proxmox.com. There we can discuss this in detail directly without having to fear to potentially leak any infos into a public forum

 

[Yariv]

How do I add it to the trust store of the hosts?

 

[aaron]

Our products are Debian based, therefore any guide on how to deploy a custom root CA to Debian should work.

In short, place the root CA .crt file into /usr/local/share/ca-certificates/ and run update-ca-certificates should do the trick.

 

[Yariv]

I guess I need to get the proxy's certificate I guess in that you will not be able to help
Thanks anyway.

 

[Yariv]

Managed to get and install the the CA locally, now running: curl https://shop.proxmox.com/ gives the whole page with no errors.
Now running pvesubscription set <key> gives a different error: Error checking subscription: https://shop.proxmox.com/modules/servers/licensing/verify.php: Network Error: Network Error: Error encountered in the status line: Connection reset by peer (os error 104)

 

[aaron]

Please open a ticket at https://my.proxmox.com. This might need a bit more troubleshooting than what I want to do via this public forum.