You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cloudstack.apache.org by "sandabot (via GitHub)" <gi...@apache.org> on 2026/01/08 17:27:10 UTC
[D] Certificate upload failed on v4.20.0 [cloudstack]
GitHub user sandabot created a discussion: Certificate upload failed on v4.20.0
I'm trying to set up a ssl cert for the console urls, following [this tutorial](https://docs.cloudstack.apache.org/en/4.20.0.0/adminguide/systemvm.html#changing-the-console-proxy-ssl-certificate-and-domains)
I set up a *.console.company.com A consoleproxyIP record in the DNS zone, I bought a wildcard ssl , but whenever I try to upload the cert&private key I get this error.
<img width="510" height="547" alt="image" src="https://github.com/user-attachments/assets/455e4b9b-76b0-4648-b968-931df0d91bbe" />
<img width="391" height="301" alt="image" src="https://github.com/user-attachments/assets/556b66a5-6551-45aa-96c6-62a6192d971c" />
I also tried with cmk, same thing. The wildcard cert is bought from ssls.com (not an ad) . The private key is in the right PKCS#8 format but I don't think that's the issue, cloudstack can't parse the certificate. I tried writing some random strings in the fields but I get the same thing. Is it a 4.20.0 bug?
GitHub link: https://github.com/apache/cloudstack/discussions/12393
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Certificate upload failed on v4.20.0 [cloudstack]
Posted by "sandabot (via GitHub)" <gi...@apache.org>.
GitHub user sandabot added a comment to the discussion: Certificate upload failed on v4.20.0
Yeah, embarassingly easy sollution, thank you!
Got confused by the placeholder and info card that stated otherwise, but makes total sense now.
<img width="248" height="95" alt="image" src="https://github.com/user-attachments/assets/6862747d-9e71-4ac9-b9ff-9be7a6c34c2b" />
And weird enough, after adding the domain and activating the ssl in the global settings, it just works, console links are working at https://console.company.com/resource/noVNC.....
Could this be done without the wildcard ssl? only with a console.company.com ssl?
Also, After uploading the cert, is there a place in the UI to manage it? Or at least be aware of it's presence that's uploaded and running?
GitHub link: https://github.com/apache/cloudstack/discussions/12393#discussioncomment-15447788
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Certificate upload failed on v4.20.0 [cloudstack]
Posted by "SviridoffA (via GitHub)" <gi...@apache.org>.
GitHub user SviridoffA added a comment to the discussion: Certificate upload failed on v4.20.0
> Could this be done without the wildcard ssl? only with a console.company.com ssl?
CloudStack has three configuration options. Take a look at this quote from the ShapeBlue article; it's also in the documentation somewhere, but I can't find it quickly.
The URL configurations can take three formats – and these also determine what kind of TLS certificate is required.
Blank: if left blank / unconfigured the URLs used for CPVM and SSVM will simply be passed as the actual public IP addresses of the system VMs.
Static URL: e.g. console.mydomain.com or ssvm.mydomain.com. In these cases CloudStack rely on external URL load balancing / redirection and/or DNS resolution of the URL to the IP address of the CPVM or SSVM. This can be achieved in a number of different ways through load balancing appliances or scripted DNS updates.
This configuration relies on:
The same URL used for both CPVM and SSVM, or
a multi-domain certificate provided to cover both URLs if different ones are used for CPVM and SSVM.
Dynamic URL: e.g. *.mydomain.com. In this case CloudStack will redirect the connections to the CPVM / SSVM to the URL “a-b-c-d.mydomain.com” where a/b/c/d represent the IP address, i.e. a real world URL would be 192-168-34-145.mydomain.com.
This relies on two things:
DNS name resolution configured for the full public system VM IP range, such that all combinations of “a-b-c-d.mydomain.com” can be resolved. Please note in CloudStack version 4.11 the public IP range used purely by system VMs can be limited by reserving a subrange of public IP addresses just for system use.
An TLS wildcard certificate covering the full “mydomain.com” domain name.
You can find this article here: https://www.shapeblue.com/securing-cloudstack-4-11-with-https-tls/
>Also, After uploading the cert, is there a place in the UI to manage it? Or at least be aware of it's presence that's uploaded and running?
As far as I know, you can't, but you can always check it via the browser's address bar. There might be some ways to do it through cloudmonkey, but I haven't used this way, so I can't say for sure.
GitHub link: https://github.com/apache/cloudstack/discussions/12393#discussioncomment-15447930
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Certificate upload failed on v4.20.0 [cloudstack]
Posted by "SviridoffA (via GitHub)" <gi...@apache.org>.
GitHub user SviridoffA added a comment to the discussion: Certificate upload failed on v4.20.0
@sandabot In the ROOT certificate field, you must insert the CA certificate from the issuing CA where you issued your certificate instead of the "wildcard". You may also need to insert an intermediate certificate (button below).
GitHub link: https://github.com/apache/cloudstack/discussions/12393#discussioncomment-15447528
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Certificate upload failed on v4.20.0 [cloudstack]
Posted by "sandabot (via GitHub)" <gi...@apache.org>.
GitHub user sandabot closed a discussion: Certificate upload failed on v4.20.0
I'm trying to set up a ssl cert for the console urls, following [this tutorial](https://docs.cloudstack.apache.org/en/4.20.0.0/adminguide/systemvm.html#changing-the-console-proxy-ssl-certificate-and-domains)
I set up a *.console.company.com A consoleproxyIP record in the DNS zone, I bought a wildcard ssl , but whenever I try to upload the cert&private key I get this error.
<img width="510" height="547" alt="image" src="https://github.com/user-attachments/assets/455e4b9b-76b0-4648-b968-931df0d91bbe" />
<img width="391" height="301" alt="image" src="https://github.com/user-attachments/assets/556b66a5-6551-45aa-96c6-62a6192d971c" />
I also tried with cmk, same thing. The wildcard cert is bought from ssls.com (not an ad) . The private key is in the right PKCS#8 format but I don't think that's the issue, cloudstack can't parse the certificate. I tried writing some random strings in the fields but I get the same thing. Is it a 4.20.0 bug?
GitHub link: https://github.com/apache/cloudstack/discussions/12393
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org