HTTPS Certificate Configuration

Introduction

This is a how-to for changing the web server certificate used by Proxmox Backup Server, in order to enable the usage of publicly trusted certificates issued by a CA of your choice (like Let's Encrypt or a commercial CA).

Important Note

Creating a new certificate requires changes the fingerprint a client will see when connecting to the server. You need to update it for all clients, else they will refuse connecting to the server!

With a trusted certificate clients do not require a fingerprint to verify the server, if your certificate is trusted you should drop the fingerprint from all client configurations to avoid updating it.

Certificate and Key File

The certificate and key, which are used for the TLS encryption by proxmox-backup-proxy are:

• /etc/proxmox-backup/proxy.pem (certificate)

The pem file contains the certificate, potentially including one or more intermediate certificates

• /etc/proxmox-backup/proxy.key (key)

The key file contains the private key used for the certificate.

File Owner and Permissions

Both files need to be owned by the root user and the backup group and should not be readable by others (mode o640):

chown root:backup /etc/proxmox-backup/proxy.pem /etc/proxmox-backup/proxy.key
chmod 640 /etc/proxmox-backup/proxy.pem /etc/proxmox-backup/proxy.key

Activating Certificate Change

Once the certificate and key files are changed you need to reload (avoid restart, they interrupt running (backup) jobs) the proxy daemon:

systemctl reload proxmox-backup-proxy

Revert to Default Configuration

You can always recreate a fresh self-signed certificate and start fresh by running:

proxmox-backup-manager cert update --force
systemctl reload proxmox-backup-proxy

WARNING: Creating a new certificate requires you to update the fingerprint for all clients, else they will refuse connecting to the server!

Let's Encrypt using acme.sh

Until Proxmox Backup Server handles issuing certificates from Let's Encrypt itself you can configure getting and refreshing certificates with external tools.

This how-to shows how to get a publicly trusted certificate from Let's Encrypt using acme.sh

The how-to only provides minimal instructions - read up on other options, which might be more fitting in your environment, for example, using the DNS challenge.

Download and Installation

You can obtain acme.sh directly from GitHub and install it to root account:

git clone https://github.com/acmesh-official/acme.sh.git
cd acme.sh && ./acme.sh --install --accountemail <your-email>

Issuing and Configuration

To write the files to the appropriate location, with fitting owner and mode for domain.example

acme.sh --issue -d domain.example --standalone \
--cert-file /etc/proxmox-backup/proxy.pem \
--key-file /etc/proxmox-backup/proxy.key \
--fullchain-file /etc/proxmox-backup/proxy.pem \
--reloadcmd "chown root:backup /etc/proxmox-backup/proxy.pem /etc/proxmox-backup/proxy.key; chmod 640 /etc/proxmox-backup/proxy.pem /etc/proxmox-backup/proxy.key ; systemctl reload proxmox-backup-proxy"

TIP: With a trusted certificate clients do not require a fingerprint to verify the server. You can drop the fingerprint from all client configurations to avoid the need to update it every two-three months, after a new Let's Encrypt certificate is required.

Automatic Renewal

In order to automatically refresh the certificates and to reload the proxy service you also need to append the reload command as renew-hook in the generated cronjob (by running crontab -e) and editing so that the line looks like:

20 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh"  --renew-hook "chown root:backup /etc/proxmox-backup/proxy.pem /etc/proxmox-backup/proxy.key; chmod 640 /etc/proxmox-backup/proxy.pem /etc/proxmox-backup/proxy.key ; systemctl reload proxmox-backup-proxy" > /dev/null

Using Certificates from Proxmox VE

If you have installed Proxmox Backup Server and Proxmox VE on the same host, you can reuse the certificates provided by Proxmox VE's ACME/Let's Encrypt integration also for the Proxmox Backup Server proxy.

You only need to schedule the copying of the certificate and key after each renewal (e.g. by creating an appropriate cronjob or systemd-timer)

The necessary commands for copying are:

NODE=$(hostname)
cp /etc/pve/nodes/${NODE}/pveproxy-ssl.pem /etc/proxmox-backup/proxy.pem
cp /etc/pve/nodes/${NODE}/pveproxy-ssl.key /etc/proxmox-backup/proxy.key
chmod 640 /etc/proxmox-backup/proxy.key /etc/proxmox-backup/proxy.pem
chgrp backup /etc/proxmox-backup/proxy.key /etc/proxmox-backup/proxy.pem
systemctl reload proxmox-backup-proxy.service