1 · Prerequisites

Confirm every item is in place before any state change.

• PVE ACME challenge is configured (DNS-01 or HTTP-01)
• ACME account is registered with the CA
• Outbound HTTPS to the CA is allowed

2 · Pre-checks

Read-only diagnostic commands. If any of these don't match expected output, stop and investigate further.

• · pvenode acme cert info shows the current cert and its expiry
• · pvenode acme account list shows the configured account
• · ACME plugin (DNS or HTTP) is configured: pvenode acme plugin list

3 · Procedure

Execute each step in order. Verify the expected output of a step before moving to the next.

1. 1Test the renewal: pvenode acme cert renew (with --force if needed)
2. 2Watch the output for challenge verification errors
3. 3If the renewal succeeded, verify the new cert: pvenode acme cert info
4. 4Reload pveproxy to pick up the new cert: systemctl restart pveproxy
5. 5Reload pvedaemon: systemctl restart pvedaemon
6. 6Verify HTTPS still works: curl -kvI https://localhost:8006/api2/json

4 · Verification

Confirm the procedure actually fixed the problem.

• ✓pvenode acme cert info shows the new cert with a future expiry
• ✓Browser HTTPS connection to the GUI works without warnings
• ✓pveproxy and pvedaemon are running with the new cert

5 · Rollback

If verification fails, undo the procedure in reverse order.

• ↶If the renewal fails, the previous cert is still in place until the next reload attempt
• ↶To manually install a cert: copy the cert and key to /etc/pve/local/pveproxy-ssl.pem and restart pveproxy

6 · Escalation

When the runbook isn't enough, contact:

• · Network admin if DNS-01 challenge cannot reach the DNS API
• · CA vendor support if account is blocked

References

1. ACME certificates