Proxmox VE

Storage and virtualisation

Renews and installs the HTTPS certificate on Proxmox VE through its API.

What happens

The appliance connects to Proxmox VE through Proxmox VE REST API on port 8006.
Discovery identifies the product, version, nodes, proxy certificate and ACME renewal.
The appliance checks the certificate, key and chain and takes over only the proxy ACME renewal before installation.
The API activates the certificate on pveproxy. Each selected node is verified before the next. If it fails: Installation stops on failure. Rollback restores the prior identity when its matching key is retained or supplied; owned ACME changes are restored without overwriting later administrator changes.
Verify checks the served leaf certificate, every required intermediate and API read-back.

Connection: The package runs on the appliance, which connects over HTTPS to Proxmox VE REST API, port 8006. No agent is installed.
Service ports: 8006
You need: API token or user@realm account. Sys.Modify on selected nodes and Sys.Audit/Sys.Modify on /.
Actions: Discovery, Installation, Verification, Rollback
Packages: proxmox-api 1.0.0
Note: Management TLS verifies CA and hostname by default. An explicit SHA-256 leaf pin or CA bundle can be used; insecure is an explicit choice.
The API does not export prior private keys. The new key is retained securely on the appliance for the next renewal; normal installation requires no prior key.
Select individual nodes or the cluster. pveproxy must use the standard key path managed by the API. A prior default certificate can also be restored by removing the custom certificate; the cluster CA remains unchanged.
Proxmox: https://www.proxmox.com; https://pve.proxmox.com/pve-docs/pve-admin-guide.html#sysadmin_certificate_management