How to install an SSL certificate in Proxmox VE

Files you need

privkey.pem and fullchain.pem, loaded from your computer. The Proxmox documentation does not describe ECDSA keys, so choose “RSA 2048” in step 1 of the generator.

Upload the certificate from production mode. A certificate from test mode is only for checking the process: browsers don't trust it, and some panels won't accept it at all.

Before you start

• Proxmox VE can get and renew Let's Encrypt certificates by itself (ACME). It needs port 80 on the server open to the internet, or a DNS provider with an API whose login details you store in Proxmox. If you have either of these, the built-in ACME is more convenient, because it renews the certificate automatically.
• Our generator is useful when the server is not reachable from the internet, when you do not want to open port 80, or when you do not want to give the server access to your DNS zone. In the generator, choose the “DNS record” method and add the record by hand in your domain's DNS panel. The file method does not fit here, because the Proxmox interface runs on port 8006 and not on a website where you could upload a file.
• In a cluster, each node has its own certificate, and you upload it separately on each node. The certificate must cover the name of that node. You can upload one wildcard certificate (for example *.yourdomain.com) to all nodes.
• If the node has ACME domains configured (on the same “Certificates” page, below the list of certificates), Proxmox may replace your certificate with its own before it expires. If you do not use ACME, remove those entries.

Step by step

1. Sign in to the Proxmox VE web interface (https://server-address:8006). On the left, under “Datacenter”, click the name of the node.
2. In the node menu, in the “System” group, click “Certificates”.
3. Click “Upload Custom Certificate”.
4. Next to each of the two fields, click “From File” and select the file (see below for which file goes where). You can also paste the file contents straight into the fields.
5. Click “Upload”. Proxmox restarts the web interface service and reloads the page by itself after about 10 seconds. If it does not, reload the page yourself.
6. Open the interface at the address on your domain, for example https://pve.yourdomain.com:8006, and check the padlock in your browser. In a cluster, repeat these steps on every node.

Which file goes into which field

• Private Key (Optional): the privkey.pem file. Despite the word “Optional”, always fill in this field, because every certificate from the generator has a new key.
• Certificate Chain: the fullchain.pem file (the certificate together with the intermediate certificate).

Checking the result

Open your website over https:// and click the padlock (or the settings icon) next to the address. The certificate details should show Let's Encrypt as the issuer and an expiry date matching the panel. If the browser still shows the old certificate, wait a few minutes and reload the page.

If you see a warning instead of your website, we explain the error codes on the page “Your connection is not private”. If the site opens over https but looks broken or something doesn't work, see mixed content. Finally, turn on the redirect from http to https so everyone lands on the secure version.

Good to know

• Proxmox checks that the key matches the certificate. If it does not, Proxmox rejects the files and keeps the previous certificate. The most common cause is files from two different orders.
• The “Delete Custom Certificate” button on the same page brings back the certificate generated by Proxmox. The browser will show a warning again, but the interface will keep working.
• The certificate only covers the Proxmox web interface and API. Websites in your virtual machines and containers need their own certificates.
• If you prefer the command line, copy both files to the node (for example with WinSCP), open “Shell” in the node menu, go to the folder with the files and run:

  pvenode cert set fullchain.pem privkey.pem --force 1 --restart 1

When you renew

Generate a new certificate and upload it the same way: “Certificates” → “Upload Custom Certificate”, the new privkey.pem and fullchain.pem, “Upload”. The new certificate replaces the old one. Proxmox will not renew it by itself, so keep an eye on the date (we will remind you by email). In a cluster, renew the certificate on every node.

Hosting panels change from time to time. If something looks different from this guide, write to kontakt@freessl.pl and we'll update it.