Uploading certificates caused access issues on Proxmox, and the fix is a single chown command. The web UI uploads the cert files with the wrong user ownership, and pveproxy refuses to read them.
What the GUI upload actually does
When you upload a certificate through the Proxmox web interface, it writes the files to /etc/pve/nodes/<node>/. But it does so as the www-data user, not as root. pveproxy runs as www-data, so you’d think that’s fine. It’s not. The files need to be owned by root:www-data with 0640 permissions, and the GUI upload leaves them as www-data:www-data.
That ownership mismatch is what breaks access. pveproxy can’t read the key file, so it fails to start or keeps serving the old cert. The error in the logs is usually something like unable to load certificate or permission denied on the key file.
The fix: chown the cert files
SSH into the node and run this, replacing <node> with your actual node name:
chown root:www-data /etc/pve/nodes/<node>/pve-ssl.key /etc/pve/nodes/<node>/pve-ssl.pem
chmod 0640 /etc/pve/nodes/<node>/pve-ssl.key /etc/pve/nodes/<node>/pve-ssl.pemThen restart pveproxy:
systemctl restart pveproxyThat’s it. The web UI should come back up with the new cert.
Why the GUI upload is a trap
I get why Proxmox lets you upload certs from the browser. It’s convenient. But the fact that it silently breaks permissions is a pain in the butt. You’d think they’d handle the ownership automatically, but apparently not.
If you’re doing this often, just scp the cert files directly to /etc/pve/nodes/<node>/ as root. That keeps the ownership correct from the start. Or use the CLI: pvenode cert set handles the permissions for you.
Still locked out?
If you can’t SSH in either, check my post on recovering Proxmox from the console. You can fix the permissions from a root shell there.
And if pveproxy is just being stubborn, the web GUI fix guide has more things to try.
