Generate an SSL certificate for the Proxmox web interface

The Proxmox web interface, which you use to manage virtual machines, comes with a self-signed certificate. A certificate from your own CA secures the connection between the browser and the server and removes the warning. This is how I generate one.

Generate a SAN certificate covers the process in more detail, including how to convert the certificate to a PFX file for Windows.

Write the request configuration

First, create a configuration file with your organisation’s details and every DNS name and IP address the certificate must cover. I call it san.cnf, but any name works, such as certificate.conf or the host name.

[req]
distinguished_name = req_distinguished_name
req_extensions = req_ext
prompt = no

[req_distinguished_name]
C = CH
ST = VD
L = Lausanne
O = MyCompany
OU = MyDept
CN = myhost.fqdn.local

[req_ext]
subjectAltName = @alt_names

[alt_names]
IP.1 = 192.168.10.1
IP.2 = 192.168.10.2
IP.3 = 192.168.10.3
IP.4 = 192.168.10.4
DNS.1 = myhost.fqdn.local
DNS.2 = myhost.mycompanydomain.com
DNS.3 = myhost2.mylegacycompanydomain.com
DNS.4 = myhost2.mycompanydomain.com

Replace the values with your own:

• req_distinguished_name describes your organisation. C must be a two-letter country code, otherwise a Microsoft CA rejects the request with error 0x80094001.
• alt_names lists the IP addresses and DNS names the certificate covers. Browsers only check these names, not the CN, so include the CN here too.

Create the key and the request

openssl req -out myhost.csr -newkey rsa:2048 -nodes -keyout myhost.key -config san.cnf

This creates two files:

• myhost.csr, the certificate request you submit to your certificate authority;
• myhost.key, the private key that belongs to the certificate.

You can submit the request to a private or a public CA. A public CA only issues certificates for public domain names that you can prove you own, and never for IP addresses, so remove IP.1 to IP.4 if you use one.

Install the certificate

Once the CA has signed the request, go to the node in the Proxmox web interface, open System → Certificates and choose Upload Custom Certificate. Paste or upload the signed certificate and the private key myhost.key. The web interface is then served over HTTPS with your certificate, covering all the names you listed.

Keep the files somewhere safe and back up the private key. Without it the certificate is useless, and you would have to start again.