From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id D9FC01FF0E9 for ; Thu, 30 Jul 2026 15:32:23 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 74935214E7; Thu, 30 Jul 2026 15:32:14 +0200 (CEST) From: Shannon Sterz To: pbs-devel@lists.proxmox.com Subject: [PATCH proxmox-backup 08/16] docs: document force refreshing long-lived certificates Date: Thu, 30 Jul 2026 15:31:50 +0200 Message-ID: <20260730133158.418015-9-s.sterz@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260730133158.418015-1-s.sterz@proxmox.com> References: <20260730133158.418015-1-s.sterz@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1785418313604 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.143 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: DTIXY7DL7YV2SSAKZLRQ6ACATXEB5DI4 X-Message-ID-Hash: DTIXY7DL7YV2SSAKZLRQ6ACATXEB5DI4 X-MailFrom: s.sterz@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: to avoid log messages added previously Signed-off-by: Shannon Sterz --- docs/certificate-management.rst | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/docs/certificate-management.rst b/docs/certificate-management.rst index 89f628049..7cbc13bcd 100644 --- a/docs/certificate-management.rst +++ b/docs/certificate-management.rst @@ -333,3 +333,34 @@ Test your new certificate, using your browser. .. [1] acme.sh https://github.com/acmesh-official/acme.sh + +Manually Renew Self-signed Certificates +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Proxmox Backup Server creates and renews a self-signed certificate if no custom +or ACME certificate is provided. Older versions issued a certificate that was +valid for almost 1000 years and did not renew this certificate. Beginning with +version 4.3, new setups use short-lived certificates that will be regularly +renewed. Old self-signed certificates are not replaced in order to not disrupt +existing backup setups. In such cases, the following line is logged: + +.. code-block:: console + + Apr 04 12:17:51 pbs proxmox-daily-update[1170]: Self-signed certificate is valid for an excessive amount of time. Please renew it. + +To manually renew a certificate, navigate to Configuration -> Certificates. +Select the certificate ``proxy.pem``. Then click the "Delete Custom +Certificate" button. Alternatively, you can run the following command: + +.. code-block:: shell + + proxmox-backup-manager cert update --force + +.. WARNING:: Any client using a fingerprint to verify TLS sessions with the + server will need to be updated with the new fingerprint. This includes any + Proxmox VE instance that may use it as a backup destination. + +After manually renewing the certificate once, Proxmox Backup Server will start +renewing the certificate itself. A certificate will be renewed at the earliest +15 days before it expires. Starting from 30 days before it expires, +notifications will be issued with a reminder about the upcoming renewal. -- 2.47.3