How to Install an SSL Certificate on Proxmox

This tutorial shows you how to install an SSL certificate on Proxmox Virtual Environment (Proxmox VE) so the web interface is served over trusted HTTPS instead of the default self-signed certificate. You will also find the best place to buy an affordable SSL certificate for Proxmox.

If you’ve already generated the CSR code and received your SSL files, skip straight to the installation instructions.

Generate a CSR code on Proxmox

To get an SSL certificate from a trusted Certificate Authority (CA), you must first generate a CSR code and send it to the certificate provider. CSR stands for Certificate Signing Request: a block of encoded text that contains your contact details, such as domain name and company identity, along with the public key that will be embedded in your certificate.

You have two options:

1. Generate the CSR automatically with our CSR Generator.
2. Follow our step-by-step tutorial on how to create a CSR on Proxmox.

Submit the CSR to the Certificate Authority during checkout. Once the CA validates your request and issues the certificate, continue with the installation below.

Install an SSL certificate on Proxmox

After your CA signs the certificate and emails you the SSL files, you can begin the installation. Proxmox VE replaces its default self-signed certificate with your custom one. You do not edit a web server config or restart Apache/Nginx by hand, because Proxmox manages its own pveproxy service.

Before you start

• Have your signed SSL files from your CA ready.
• Make sure your private key is not password-protected; Proxmox will not accept an encrypted key.
• You apply the certificate per node. In a cluster, repeat these steps on each node you want to secure.

These steps apply to Proxmox VE 7, 8, and the current 9.x release line. The certificate workflow is identical across these versions.

Step 1: Prepare the installation files

Download the ZIP archive your CA sent you and extract it on your computer. To activate SSL on Proxmox you need exactly two files:

• fullchain.pem, your server certificate plus all intermediate certificates (excluding the root), merged into a single PEM file.
• private-key.pem, your private key in PEM format, without a password.

Depending on your CA, you may receive the root and intermediate certificates as separate files or bundled in a single .ca-bundle file. For Proxmox, you must combine your server certificate and the intermediate(s) into one fullchain.pem file. Open a plain-text editor and paste the contents of each certificate into a single file.

The order matters. The full-chain file must start with your server (leaf) certificate, followed by the intermediate certificate(s). Each certificate block runs from its —–BEGIN CERTIFICATE—– line to its —–END CERTIFICATE—– line, like this:

-----BEGIN CERTIFICATE-----
(your server / leaf certificate)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(intermediate certificate)
-----END CERTIFICATE-----

Step 2: Upload the certificate via the Proxmox GUI

The web interface is the simplest method, especially if you manage a single node:

1. Log in to the Proxmox web interface.
2. In the left panel, expand Datacenter, select your node, then go to System → Certificates.
3. Under pveproxy-ssl.pem, click Upload Custom Certificate.
4. Paste (or upload) your fullchain.pem into the Certificate Chain field and your private-key.pem into the Private Key field.
5. Click Upload. When prompted to restart the web service, confirm. Proxmox reloads pveproxy and starts serving your new certificate.

After the restart, reload the web interface in your browser. You should now see your trusted certificate instead of the default self-signed one.

Alternative: install the certificate from the command line

If you prefer the shell, copy your fullchain.pem and private-key.pem to the node over SSH (for example with scp), then use the built-in pvenode tool. It validates that the certificate and key match before installing them and can restart the proxy in one step:

pvenode cert set fullchain.pem private-key.pem --force --restart

The –force flag overwrites any existing custom certificate, and –restart reloads the web service so the change takes effect immediately.

You can also place the files manually. Proxmox reads the active node’s certificate from /etc/pve/local/pveproxy-ssl.pem and its key from /etc/pve/local/pveproxy-ssl.key (where /etc/pve/local is a symlink to the current node’s directory). Copy your files into place, adjusting the source paths to match your own:

cp fullchain.pem /etc/pve/local/pveproxy-ssl.pem
cp private-key.pem /etc/pve/local/pveproxy-ssl.key

Then restart the web interface to load the new certificate:

systemctl restart pveproxy

You should see a log message confirming Proxmox is now using your new certificate.

Alternative: get a free certificate with Proxmox’s built-in ACME (Let’s Encrypt)

Proxmox VE ships with a native ACME client, so you can issue and auto-renew a free Let’s Encrypt certificate without buying one or running external tools. This is ideal when your node has a public DNS name (the HTTP-01 challenge needs ports 80/443 reachable from the internet) or when you can use a supported DNS provider for the DNS-01 challenge.

1. Go to Datacenter → ACME and register an account under Accounts (choose the Let’s Encrypt directory and accept the terms). ACME accounts are configured once at the datacenter level.
2. Open your node → System → Certificates, and under ACME add the domain(s) for that node and select your challenge type (HTTP or DNS).
3. Click Order Certificates Now. Proxmox completes the challenge, installs the certificate, and renews it automatically before expiry.

Test your SSL installation

After installing the certificate, run a quick check for errors and vulnerabilities. The fastest way is to open the Proxmox web interface in your browser and confirm the padlock shows a valid, trusted certificate with the correct domain and expiry date.

From the command line, you can read back exactly what the node is serving on its default port (8006):

echo | openssl s_client -connect your-proxmox-host:8006 -servername your-proxmox-host 2>/dev/null | openssl x509 -noout -issuer -subject -dates

This prints the issuer, subject, and validity dates of the live certificate. For a full external scan, see our guide to the best SSL Checker for checking your installation.

Where to buy the best SSL certificate for Proxmox?

When buying an SSL certificate, weigh the validation type, price, and customer service. At SSL Dragon we offer one of the widest ranges of SSL certificates, highly competitive prices, and dedicated support. Every certificate is issued by a trusted Certificate Authority and is fully compatible with Proxmox Virtual Environment. Whether you need an affordable Domain Validation certificate or a premium Extended Validation product, we’ve got you covered.

Frequently Asked Questions

Bottom line

Installing an SSL certificate on Proxmox VE comes down to building a full-chain PEM file, uploading it with your unencrypted key via System → Certificates (or with pvenode cert set on the command line), and letting Proxmox restart its pveproxy service. For a hands-off setup, the built-in ACME client issues and auto-renews a free Let’s Encrypt certificate. Need a certificate first? Browse our SSL certificates.