With pve-manager 7.2-11- pve-daily-update.service fails (for us)

[DirkH]

Hi,
I updated yesterday to pve-manager 7.2.11. Now the pve-daily-update.service fails with
Sep 23 10:32:12 proxhan01 pveupdate[1586625]: thread '<unnamed>' panicked at 'Failed to add native certificate too root store: BadDer', /usr/share/cargo/registry/ureq-2.4.0/src/rtls.rs:73:14 Sep 23 10:32:12 proxhan01 pveupdate[1586625]: note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace Sep 23 10:32:12 proxhan01 pveupdate[1586625]: fatal runtime error: failed to initiate panic, error 5

Other system versions:

proxmox-ve: 7.2-1 (running kernel: 5.15.53-1-pve) pve-manager: 7.2-11 (running version: 7.2-11/b76d3178) pve-kernel-helper: 7.2-12 pve-kernel-5.15: 7.2-10 pve-kernel-5.13: 7.1-9 pve-kernel-5.15.53-1-pve: 5.15.53-1 pve-kernel-5.15.39-4-pve: 5.15.39-4 pve-kernel-5.13.19-6-pve: 5.13.19-15 pve-kernel-5.13.19-2-pve: 5.13.19-4 ceph: 16.2.9-pve1 ceph-fuse: 16.2.9-pve1 corosync: 3.1.5-pve2 criu: 3.15-1+pve-1 glusterfs-client: 9.2-1 ifupdown: 0.8.36+pve1 ksm-control-daemon: 1.4-1 libjs-extjs: 7.0.0-1 libknet1: 1.24-pve1 libproxmox-acme-perl: 1.4.2 libproxmox-backup-qemu0: 1.3.1-1 libpve-access-control: 7.2-4 libpve-apiclient-perl: 3.2-1 libpve-common-perl: 7.2-2 libpve-guest-common-perl: 4.1-2 libpve-http-server-perl: 4.1-3 libpve-storage-perl: 7.2-8 libqb0: 1.0.5-1 libspice-server1: 0.14.3-2.1 lvm2: 2.03.11-2.1 lxc-pve: 5.0.0-3 lxcfs: 4.0.12-pve1 novnc-pve: 1.3.0-3 proxmox-backup-client: 2.2.6-1 proxmox-backup-file-restore: 2.2.6-1 proxmox-mini-journalreader: 1.3-1 proxmox-widget-toolkit: 3.5.1 pve-cluster: 7.2-2 pve-container: 4.2-2 pve-docs: 7.2-2 pve-edk2-firmware: 3.20220526-1 pve-firewall: 4.2-6 pve-firmware: 3.5-1 pve-ha-manager: 3.4.0 pve-i18n: 2.7-2 pve-qemu-kvm: 7.0.0-3 pve-xtermjs: 4.16.0-1 qemu-server: 7.2-4 smartmontools: 7.2-pve3 spiceterm: 3.2-2 swtpm: 0.7.1~bpo11+1 vncterm: 1.7-1 zfsutils-linux: 2.1.5-pve1

Any idea?

Dirk

 

[fabian]

do you have any custom certificates added to the certificate store trusted by the system?

 

[DirkH]

Hi Fabian,
thanks for the answer.

Uhm which store?
We have custom-ca-certificates via
/usr/local/share/ca-certificates/
and
pveproxy-ssl.pem
for the nodes in the /etc/pve/nodes/xxx/.

 

[fabian]

yeah, /usr/local/share/ca-certificates - it seems that contains an invalid file/certificate that our code chokes on.

 

[DirkH]

Right!
After removing an old certificate from 1999 it works again.
Looks like it's an old debt in our ansible.
Thank You.
Solved!