[BUG] Proxmox certificate is not reloaded after renewal

[peterurbanec]

Description

When ProxMenux Monitor is configured to use Proxmox certificates and Proxmox uses ACME protocol to renew the certificate, the new cert is not used by ProxMenux Monitor. Instead, ProxMenux Monitor continues to use the old, revoked, certificate, which causes browser errors and refusal to connect.

Steps to Reproduce

1. Configure ProxMenux Monitor to use Proxmox certificates for HTTPS.
2. Wait for certificate to be renewed, without restarting the node or ProxMenux Monitor.
3. Reload a page using Firefox

At this stage you will get a revoked certificate error.

Expected Behavior

ProxMenux Monitor should notice when Proxmox has renewed the Let's Encrypt certificates and use the new certs.

[MacRimi]

Hi @peterurbanec,

Thank you for the clear report. I have confirmed the cause: ProxMenux Monitor loaded the TLS certificate into memory when the server started, so a certificate renewed by Proxmox ACME was not used until the Monitor was restarted.

This has now been corrected for the upcoming v1.2.4.2 beta:

• Settings > Security now includes an Update certificate action.
• ProxMenux reads the current Proxmox certificate and private key again, validates that they match, and activates the renewed certificate for subsequent TLS connections.
• The Monitor service is not restarted, so the dashboard, running operations, WebSocket connections and background tasks are not interrupted.
• If the active certificate already matches the files provided by Proxmox, the interface reports that no change was necessary.

The check is intentionally user-triggered rather than performed every 60 seconds or every hour. After Proxmox renews its ACME certificate, opening Settings > Security and selecting Update certificate will activate it immediately.

I will keep this issue open until the beta is available and the behavior can be confirmed in a real ACME renewal. Thanks again for helping improve ProxMenux.

[peterurbanec]

Would this not lead to a catch22 situation? If the certificate is revoked, you won't be able to connect and that in turn prevents you from requesting the certificate update using the user interface.

I agree that polling for file changes is less than ideal, but perhaps setting up a inotify on the cert file? If the certificate is updated after the initial load, the app could receive a notification and reload it.

[MacRimi]

Thanks for pointing this out. Your observation made me reconsider the approach.

I considered using inotify, but /etc/pve is backed by pmxcfs, and changes made through the cluster stack do not reliably generate local inotify events. Relying on it alone could therefore cause ProxMenux to miss an ACME renewal.

The solution I have implemented is for ProxMenux to check the preferred Proxmox certificate and private key whenever a client starts a new TLS connection. If the pair has changed and is valid, ProxMenux creates and selects a new SSL context before presenting the certificate to the client.

If Proxmox is still writing the files, or if the certificate and private key do not match, ProxMenux continues using the last successfully validated context instead of interrupting access. The manual Update certificate action remains available under Security for diagnostics and recovery. Enabling or disabling HTTPS still performs the usual controlled restart because that changes the server protocol.
I have verified the flow using real TLS handshakes, both with and without SNI, as well as with incomplete and mismatched certificate pairs. I’ll keep the issue open until the next beta is available so it can be validated against a real Proxmox ACME renewal.