How-To Create and Install an SSL Certificate for Proxmox

 

 

Audience

This document is intended for Server Administrators. As this is a Proxmox virtual hosting environment it does not fall under Windows or Linux per se', but the underlying OS is Linux based so we are placing it under the Linux How-To area.

 

Overview

This how-to document provides guidance on the proper steps to create, request, and install an SSL certificate on a Proxmox host to allow for secure communications via a web browser.

 

Certificate Request and Installation

Three steps are required to complete the SSL certificate process

Step one is to create the certificate request files. To perform this action you should use the OpenSSL tools. This tool is installed on "SVCTOOLS" server.

  1. Remote in to or access the SVCTOOLS server
  2. Using either Windows Explorer or other tool, navigate to the "E:\certs\" drive and create a new folder "SERVER_DNS_NAME".
  3. Create the request file(s)
    1. Open a Command Prompt with Administrative rights.
    2. Navigate to the new folder you just created above.
    3. Run the below command replacing the server DNS name with the one you are working on.
      1. openssl req -new -newkey rsa:2048 -nodes -keyout SERVER_DNS_NAME.key -config "C:\Program Files (x86)\GnuWin32\share\openssl.cnf" -out SERVER_DNS_NAME.csr
      2. The above step will begin the process of creating the self-signed certificate and will ask you to provide the below information:
        1. Country Name: US
        2. State or Province Name: Pennsylvania
        3. Location Name: Pittsburgh
        4. Organization Name: University of Pittsburgh
        5. Organizational Unit Name: HSIT
        6. Common Name: FQDN.hs.pitt.edu or the FQDN of the server
        7. Email Address: svc-itargetnetwork@pitt.edu
      3. This process will create the below files
        1. SERVER_DNS_NAME.key - This is your private key DO NOT give it out.
        2. SERVER_DNS_NAME.csr - This is your certificate request file and is used for requesting a certificate from Pitt.
        3. .rnd - I have no clue what this is, but I don't believe it matters. I think it is just used for the creation process.
  4. Using the above request file (SERVER_DNS_NAME.csr) follow HSIT normal procedures to request a valid certificate from Pitt.
    1. Visit <https://cert-manager.com/customer/InCommon/ssl?action=enroll>
    2. Enter the access code: UPitt
    3. Enter email address: svc-ssladmin@pitt.edu
    4. Click the "Check Access Code" button
    5. Paste the CSR into the text box on the form
    6. Click the "Get Common Name from CSR" button
    7. Select the Certificate type, for a single hostname: InCommon SSL (SHA-2), more than one hostname: InCommon Multi Domain SSL option and enter all of the hostnames in the "Subject Alternative Names" field.
    8. Select your Server Type: Microsoft IIS 5 and later
    9. Select the certificate term 1 year.
    10. Enter and verify a pass-phrase for the certificate: itarget
    11. External Requester: svc-ssladmin@pitt.edu
    12. In the "Comments" field, enter a brief description of the use for the certificate
    13. Click the "Submit" button
      Send request for approval to Pitt
    14. Wait for certificate email from InCommon and follow directions
    15. Once new cert is installed revoke the old cert.
  5. After you have received the Certificate E-mail Response perform the below actions
    1. Open the E-mail response and download all certificates.
    2. Copy all downloaded certificate to the "SVCTOOLS" server and place them in the folder you created above.
  6. Using your browser of choice open the Proxmox server you are working on.
    1. Click "Advanced" on the warning page.
    2. Click "Accept the Risk and Continue".
    3. From the main screen login with root (or appropriate account that has administrative/root access).
    4. Click "OK" to ignore the "No valid Subscription" message.
    5. On the left side of the main screen click on the server you are working with.
    6. Navigate and click the path below:
      1. System --> Certificates
      2. Click the "Upload Custom Certificate" button in the top middle of the screen. This will display the location of where you place the PEM content for the Private Key and entire certificate chain excluding the Root.
      3. Using the Private Key you created from OpenSSL tool named SERVER_DNS_NAME.key.
        1. There are two ways to place the PEM code in the block provided
        2. View the contents of that file using Notepad++ or other text editor. Highlight all data within the file and copy it to the block provided.
        3. You can also click the "From File" button to locate and upload the file. This will place the content in the block provided.
        4. The results will look as shown below:
      4. Using the certificate chain PEM file you received from the Pitt E-mail named SERVER_DNS_NAME.pem.
        1. There are two ways to place the PEM code in the block provided
        2. View the contents of that file using Notepad++ or other text editor. Highlight all data within the file and copy it to the block provided.
        3. You can also click the "From File" button to locate and upload the file. This will place the content in the block provided.
        4. The results will look as shown below:
    7. To complete the process click the "Upload" button. This will initiate a process that configures the new certificate and restarts the web interface. You should see a notice displayed indicating this.
    8. Upon completion of the restart of the web interface you will be sent back to the web page. If this does not show the HTTPS secure icon you may need to open a different tab to display it properly.

​​​​​​​

Troubleshooting

If the certificate is broken you can revert back to teh default self signed certificate that is installed during the Proxmox installation.

To perform a restore of a broken certificate perform the below steps.

  1. Access the host Proxmox server from any tool that provides a command prompt screen. You can do this locally on the system, form the iDRAC console, or SSH if available.
  2. Login as "Root" or other administrative capable account.
  3. Navigate to the directory "/etc/pve/nodes/NODENAME". NOTE the NODENAME = SERVER_DNS_NAME.
  4. Delete the below files:
    1. pveproxy-ssl.key
    2. pveproxy-ssl.pem
  5. Restart the server OR run the command "systemctl restart pveproxy".
  6. Refresh your browser or open a new tab and you should be able to login back in with the default certificates..

 

REFERENCES:

https://pve.proxmox.com/wiki/Certificate_Management

https://medium.com/@munteanu210/how-to-install-an-ssl-certificate-on-proxmox-4836719ac7c9

 

Feedback and Concerns:

Our articles are continuously improving, and your feedback helps us make them even better. If you have any comments or suggestions about this article, please email hsitkb@pitt.edu or use the "Was this helpful?" section below to leave a response.

Print Article