Proxmox Mail Gateway

Mail server

Renews and installs the HTTPS certificate on Proxmox Mail Gateway through its API.

What happens

The appliance connects to Proxmox Mail Gateway through Proxmox Mail Gateway REST API on port 8006.
Discovery identifies the product, version, nodes, proxy certificate and ACME renewal.
The appliance checks the certificate, key and chain and takes over only the proxy ACME renewal before installation.
The API activates the certificate on pmgproxy. Each selected node is verified before the next. If it fails: Installation stops on failure. Rollback restores the prior identity when its matching key is retained or supplied; owned ACME changes are restored without overwriting later administrator changes.
Verify checks the served leaf certificate, every required intermediate and API read-back.

Connection: The package runs on the appliance, which connects over HTTPS to Proxmox Mail Gateway REST API, port 8006. No agent is installed.
Service ports: 8006
You need: root@pam or a user@realm account with the admin role for ticket login. Audit accounts can read discovery.
Actions: Discovery, Installation, Verification, Rollback
Packages: proxmox-api 1.0.0
Note: Management TLS verifies CA and hostname by default. An explicit SHA-256 leaf pin or CA bundle can be used; insecure is an explicit choice.
The API does not export prior private keys. The new key is retained securely on the appliance for the next renewal; normal installation requires no prior key.
PMG clusters are processed with the master last; its recorded node fingerprint is verified. SMTP-only ACME is preserved and api+smtp becomes smtp-only. SMTP certificates and mail settings remain unchanged. Reset is not used as rollback.
Proxmox: https://www.proxmox.com; https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#sysadmin_certs