WebAuthn "no webauthn configuration available" — Fresh 8.4.1 install, previously worked

[chance]

Title: WebAuthn "no webauthn configuration available" — Fresh 8.4.1 install, previously worked

Hi all,

I'm trying to enable WebAuthn passkey login for a single user (`root@pam`) on a fresh install of Proxmox VE 8.4.1. This setup worked perfectly last week — same hardware, same domain, same proxy config — but now I consistently get the error:

no webauthn configuration available

Goal

• Enable passkey login (Touch ID via Safari on macOS)
• Use valid HTTPS (Let's Encrypt cert via Caddy reverse proxy)
• Access over DuckDNS (public domain with internal routing)
• No TOTP or fallback 2FA — passkey-only login for `root@pam`

Setup

• Proxmox VE 8.4.1 (clean install, not upgraded)
• Caddy reverse proxy using Let’s Encrypt certificate:
  

  butch-proxmox.duckdns.org {
      reverse_proxy 127.0.0.1:8006
      encode zstd gzip
      log {
          output file /var/log/caddy/proxmox-access.log
          format json
      }
  }

• DuckDNS domain: https://<redacted>.duckdns.org
• HTTPS verified, no issues with cert trust in browser
• Touch ID working for other WebAuthn sites
• macOS client; also tested Chrome with local DNS override

What I’ve Tried

- Created /etc/pve/priv/tfa.json with:

{
  "webauthn": {
    "origin": "https://<redacted>.duckdns.org"
  }
}

Verified ownership: root:www-data, permissions 600

- Restarted:

systemctl restart pveproxy
systemctl restart pvedaemon
systemctl restart pvestatd

- Installed required Perl module:

apt install cpanminus build-essential libssl-dev libperl-dev
cpanm Authen::WebAuthn
perl -MAuthen::WebAuthn -e 1

- Cleaned up /etc/pve/domains.cfg:

pam: pam
    comment Linux PAM standard authentication

- Removed all TOTP configs (no :totp or :x: flags in /etc/pve/user.cfg)

- Tried enabling WebAuthn in GUI under:
Datacenter → Permissions → Realms → pam → TFA
(no effect — origin field never appears)

- Log output journalctl -u pveproxy -f showed (before fix):

file /etc/pve/domains.cfg line 4 (skip section 'pam'): unsupported type 'realm'

Fixed after correcting realm: pam → pam: pam

Even after all this, still getting:

Error: no webauthn configuration available

Notes
- Exact same config worked a week ago (Touch ID WebAuthn)
- This is a single-node system, no cluster
- Fully valid HTTPS + DuckDNS + proper certs
- WebAuthn module is present and working in Perl

Ask:
What else can I check to get Proxmox to recognize `tfa.json`?
Is there a change in 8.4.1 that requires additional WebAuthn configuration?
Is there a known way to force backend reload of the config?

Happy to post logs, debug output, or minimal repro.

Thanks!
— Chance?

 

[chance]

I've been working on this for hours. The moment I post on the forums, I get an upsight - READ THE DOCUMENTATION

https://pve.proxmox.com/pve-docs/pve-admin-guide.html#pveum_configure_webauthn

14.6.6. WebAuthn​

For WebAuthn to work, you need to have two things:

• A trusted HTTPS certificate (for example, by using Let’s Encrypt). While it probably works with an untrusted certificate, some browsers may warn or refuse WebAuthn operations if it is not trusted.
• Setup the WebAuthn configuration (see Datacenter → Options → WebAuthn Settings in the Proxmox VE web interface). This can be auto-filled in most setups.

Once you have fulfilled both of these requirements, you can add a WebAuthn configuration in the Two Factor panel under Datacenter → Permissions → Two Factor.

I never read the documentation. Maybe I will start.

 

[snth]

Thank you for this @chance . Also spent part of an hour trying to get this to work before I happened upon your post.

I did consult the documentation but it took me straight to https://pve.proxmox.com/pve-docs/pve-admin-guide.html#pveum_configure_webauthn so I missed that one paragraph up it gives the breadcrumb trail for how to navigate to the config screen. Also, the picture on the right hand side was too small for me to make out the details so I also missed the details which would have shown that it's the webauthn config. Just leaving these comments here in case they are useful for anyone else.

Anyway, it's working now!