Fix Proxmox Web Interface Certificate Warning (self-signed)

Quick answer: Either add a real certificate from Let's Encrypt (recommended) or tell your browser to trust the self-signed one. Skip the scare — it's just Proxmox not having a public CA-signed cert.

Why this happens

When you install Proxmox VE (version 5.x through 8.x), the web interface automatically uses a self-signed SSL certificate. This is fine for testing or internal networks, but browsers like Chrome, Firefox, and Edge throw a big red warning because they don't trust certificates signed by themselves. The error looks like NET::ERR_CERT_AUTHORITY_INVALID or SEC_ERROR_UNKNOWN_ISSUER. I know it's annoying — you just want to see the dashboard, not a security popup.

This happens because Proxmox generates a random certificate during installation. It's not signed by a trusted Certificate Authority (CA) like Let's Encrypt, DigiCert, or GoDaddy. Your browser has a list of CAs it trusts, and your Proxmox server's cert isn't on that list. So it warns you. That's all.

Fix 1: Use Let's Encrypt (the real fix)

If your Proxmox server has a public hostname (like proxmox.yourdomain.com) and port 80/443 is reachable from the internet, Let's Encrypt is the best option. It's free, automatic, and your browser will trust it. Here's how:

1. SSH into your Proxmox host.
2. Run pveceph install (only if you need Ceph — skip if not). Actually, the real command is apt update && apt install pvecontainer — no wait, just do apt install certbot.
3. Stop the Proxmox web interface temporarily: systemctl stop pveproxy.
4. Request a certificate with certbot certonly --standalone -d proxmox.yourdomain.com. Replace the domain with yours.
5. Copy the cert files: cp /etc/letsencrypt/live/proxmox.yourdomain.com/fullchain.pem /etc/pve/local/pve-ssl.pem
6. Copy the private key: cp /etc/letsencrypt/live/proxmox.yourdomain.com/privkey.pem /etc/pve/local/pve-ssl.key
7. Set proper permissions: chmod 600 /etc/pve/local/pve-ssl.key
8. Restart the web interface: systemctl start pveproxy
9. Test by opening https://proxmox.yourdomain.com:8006 in a browser. The warning should be gone.

Fix 2: Accept the self-signed cert (quick and dirty)

If your server isn't public (like home lab or internal only), just tell your browser to trust it. Takes 10 seconds:

• Chrome/Edge: Click Advanced then Proceed to [IP] (unsafe). The warning goes away for that session. For permanent trust, export the cert from Proxmox (go to Datacenter > Options > SSL Certificate), import it into your system's trust store.
• Firefox: Click Advanced > Accept the Risk and Continue. Or import the cert into Firefox via Settings > Privacy & Security > Certificates.
• Safari: Click Show Certificate > Trust dropdown > set to Always Trust.

Fix 3: Use your own CA-signed certificate

If you have a certificate from a company CA (like a wildcard cert), you can replace the self-signed one manually. The files are in /etc/pve/local/. Backup the originals: mv pve-ssl.pem pve-ssl.pem.bak and mv pve-ssl.key pve-ssl.key.bak. Then copy your cert as pve-ssl.pem and key as pve-ssl.key. Restart pveproxy. That's it.

What if the main fix fails?

Sometimes Let's Encrypt fails because port 80 is blocked, or your domain doesn't resolve correctly. Here's what to check:

• Make sure port 80 (HTTP) is open in your firewall. Certbot needs it for the HTTP-01 challenge.
• Check that your domain's A record points to the public IP of your Proxmox server. Use dig proxmox.yourdomain.com to verify.
• If you're behind NAT, set up port forwarding for ports 80 and 443 to the Proxmox host.
• If all else fails, use the --manual mode with Certbot and a DNS challenge (like Cloudflare). That doesn't need open ports.

Prevention tip

Set up automatic renewal with a cron job. Let's Encrypt certs only last 90 days. Add this to your crontab (crontab -e):

0 0 * * * /usr/bin/certbot renew --quiet && systemctl restart pveproxy

This runs every day at midnight, renews if needed, and restarts Proxmox's web interface. You'll never see that warning again.

That's it. Go fix that warning — your browser will thank you, and you'll stop having to click through the scary messages every time you log in.