From 37f21c480ed26e63e301448445fe57731340fed6 Mon Sep 17 00:00:00 2001 From: Michal Fox Date: Fri, 2 Oct 2026 17:03:11 +0200 Subject: [PATCH] fix #6512: certificate management: document reverting a custom certificate The certificate management chapter explains how to upload a custom certificate, but not how to go back to the default one. This is especially needed if a broken certificate made the web interface unreachable, so that the 'Delete Custom Certificate' button cannot be used anymore. Add a section for it, with the button in the web interface and the 'pvenode cert delete --restart 1' command as fallback, which deletes the custom certificate and key and restarts pveproxy, so that it uses the default node certificate again. Signed-off-by: Michal Fox --- certificate-management.adoc | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/certificate-management.adoc b/certificate-management.adoc index 9472a6f..d77b2f7 100644 --- a/certificate-management.adoc +++ b/certificate-management.adoc @@ -68,6 +68,25 @@ can upload that certificate simply over the web interface. Note that the certificates key file, if provided, mustn't be password protected. +[[sysadmin_certs_revert_custom]] +Revert to the Default Certificate +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +To switch back from a custom certificate to the default certificate signed by +the cluster CA, delete the custom certificate of the node with the 'Delete +Custom Certificate' button under `Node -> Certificates`. + +If the web interface is not reachable anymore, for example after uploading a +broken certificate, run the following command on the node instead: + +---- +root@proxmox:~# pvenode cert delete --restart 1 +---- + +This deletes `/etc/pve/local/pveproxy-ssl.pem` and +`/etc/pve/local/pveproxy-ssl.key` and restarts `pveproxy`, which then uses the +default certificate in `/etc/pve/local/pve-ssl.pem` again. + [[sysadmin_certs_get_trusted_acme_cert]] Trusted certificates via Let's Encrypt (ACME) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~