Tag: spice

Fix Spice Certificate Issue in Proxmox

Posted on by Bian Xi Leave a Comment on Fix Spice Certificate Issue in Proxmox

Fix Spice Certificate Issue in Proxmox

After changed the display to Spice and added Spice USB device, following error appeared.

swtpm_setup: Not overwriting existing state file.
kvm: warning: Spice: reds.c:2893:reds_init_ssl: Could not load certificates from /etc/pve/local/pve-ssl.pem
kvm: warning: Spice: error:0909006C:PEM routines:get_name:no start line
kvm: warning: Spice: error:140DC009:SSL routines:use_certificate_chain_file:PEM lib
kvm: failed to initialize spice server
stopping swtpm instance (pid 55260) due to QEMU startup error
TASK ERROR: start failed: QEMU exited with code 1

Update certificate also got following errors

root@pve01:~# pvecm updatecerts --force
(re)generate node files
generate new node certificate
Signature ok
subject=OU = PVE Cluster Node, O = Proxmox Virtual Environment, CN = pve01.xxx.net
Getting CA Private Key
CA certificate and CA private key do not match
139954545105792:error:06067099:digital envelope routines:EVP_PKEY_copy_parameters:different parameters:../crypto/evp/p_lib.c:93:
139954545105792:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:../crypto/x509/x509_cmp.c:303:
unable to generate pve ssl certificate:
command 'faketime yesterday openssl x509 -req -in /tmp/pvecertreq-56235.tmp -days 161 -out /etc/pve/nodes/pve01/pve-ssl.pem -CAkey /etc/pve/priv/pve-root-ca.key -CA /etc/pve/pve-root-ca.pem -CAserial /etc/pve/priv/pve-root-ca.srl -extfile /tmp/pvesslconf-56235.tmp' failed: exit code 1

In this case, remove keys and regenerate.

root@pve01:~# rm -f /etc/pve/pve-root-ca.pem /etc/pve/priv/pve-root-ca.* /etc/pve/local/pve-ssl.*
root@pve01:~# pvecm updatecerts -f
(re)generate node files
generate new node certificate
merge authorized SSH keys and known hosts
root@pve01:~# pvecm updatecerts -f
(re)generate node files
generate new node certificate
merge authorized SSH keys and known hosts
root@pve01:~#

Now, problem fixed.

References

pveproxy fails to load local certificate chain after upgrade to pve 6

Error Starting Proxmox VM: `pve-ssl.pem` is empty

Posted on by Bian Xi Leave a Comment on Error Starting Proxmox VM: `pve-ssl.pem` is empty

Error Starting Proxmox VM: pve-ssl.pem is empty

Got following error when starting a Proxmox VM with Spice driver.

kvm: warning: Spice: reds.c:2893:reds_init_ssl: Could not load certificates from /etc/pve/local/pve-ssl.pem
kvm: warning: Spice: error:0909006C:PEM routines:get_name:no start line
kvm: warning: Spice: error:140DC009:SSL routines:use_certificate_chain_file:PEM lib
kvm: failed to initialize spice server
TASK ERROR: start failed: QEMU exited with code 1

pve-ssl.pem size

The file size of /etc/pve/local/pve-ssl.pem is 0.

Fix

Standalone server

Regenerate following files using method stated in https://pve.proxmox.com/wiki/Proxmox_SSL_Error_Fixing

/etc/pve/pve-root-ca.pem
/etc/pve/local/pve-ssl.key
/etc/pve/local/pve-ssl.pem

Cluster node

Copy following files from other Proxmox node, normally, /etc/pve/pve-root-ca.pem files are the same.

/etc/pve/nodes/<node_name>/pve-ssl.key
/etc/pve/nodes/<node_name>/pve-ssl.pem

Note: These certificates can be used for all nodes.
Note: /etc/pve/local is a link to nodes/<node_name>

References

Proxmox SSL Error Fixing