Proxmox Backup Server

Storage and virtualisation

Renews and installs the HTTPS certificate on Proxmox Backup Server through its API.

What happens

The appliance connects to Proxmox Backup Server through Proxmox Backup Server REST API on port 8007.
Discovery identifies the product, version, nodes, proxy certificate and ACME renewal.
The appliance checks the certificate, key and chain and takes over only the proxy ACME renewal before installation.
The API activates the certificate on proxmox-backup-proxy. The certificate is verified after reload. If it fails: Installation stops on failure. Rollback restores the prior identity when its matching key is retained or supplied; owned ACME changes are restored without overwriting later administrator changes.
Verify checks the served leaf certificate, every required intermediate and API read-back.

Connection: The package runs on the appliance, which connects over HTTPS to Proxmox Backup Server REST API, port 8007. No agent is installed.
Service ports: 8007
You need: API token or user@realm account. Sys.Modify on /system/certificates and audit/modify on /system.
Actions: Discovery, Installation, Verification, Rollback
Packages: proxmox-api 1.0.0
Note: Management TLS verifies CA and hostname by default. An explicit SHA-256 leaf pin or CA bundle can be used; insecure is an explicit choice.
The API does not export prior private keys. The new key is retained securely on the appliance for the next renewal; normal installation requires no prior key.
PBS has one localhost target; multiple PBS servers are separate destinations. The proxy reloads automatically. Clients pinning the old fingerprint must use the returned new fingerprint. Reset creates a new self-signed identity and is not used as rollback.
Proxmox: https://www.proxmox.com; https://pbs.proxmox.com/docs/sysadmin.html#certificate-management