fix #6512: certificate management: document reverting a custom certificate

The certificate management chapter explains how to upload a custom
certificate, but not how to go back to the default one. This is
especially needed if a broken certificate made the web interface
unreachable, so that the 'Delete Custom Certificate' button cannot be
used anymore.

Add a section for it, with the button in the web interface and the
'pvenode cert delete --restart 1' command as fallback, which deletes the
custom certificate and key and restarts pveproxy, so that it uses the
default node certificate again.

Signed-off-by: Michal Fox <me@dualfroz.com>

certificate-management.adoc

@@ -68,6 +68,25 @@ can upload that certificate simply over the web interface.
 Note that the certificates key file, if provided, mustn't be password
 protected.
 
+[[sysadmin_certs_revert_custom]]
+Revert to the Default Certificate
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+To switch back from a custom certificate to the default certificate signed by
+the cluster CA, delete the custom certificate of the node with the 'Delete
+Custom Certificate' button under `Node -> Certificates`.
+
+If the web interface is not reachable anymore, for example after uploading a
+broken certificate, run the following command on the node instead:
+
+----
+root@proxmox:~# pvenode cert delete --restart 1
+----
+
+This deletes `/etc/pve/local/pveproxy-ssl.pem` and
+`/etc/pve/local/pveproxy-ssl.key` and restarts `pveproxy`, which then uses the
+default certificate in `/etc/pve/local/pve-ssl.pem` again.
+
 [[sysadmin_certs_get_trusted_acme_cert]]
 Trusted certificates via Let's Encrypt (ACME)
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~