What's wrong about replacing /etc/pve/local/pve-ssl.* ?

[harvie]

man pveproxy says this:

Warning
Do not replace the automatically generated node certificate files in /etc/pve/local/pve-ssl.pem and etc/pve/local/pve-ssl.key


What's so wrong about replacing original snakeoil key+cert with eg. letsencrypt one? It seemed to work for me. I modified my setup so it now goes into /etc/pve/local/pveproxy-ssl.pem and .key, but i don't see reason not to overwrite original pve-ssl.key. Is that somehow related to cluster nodes identifiing each other using these certs?

 

[tom]

See also https://pve.proxmox.com/wiki/HTTPS_Certificate_Configuration_(Version_4.x_and_newer)

 

[harvie]

See also https://pve.proxmox.com/wiki/HTTPS_Certificate_Configuration_(Version_4.x_and_newer)

I don't really see any full explanation there. What part exactly are you talking about?