Add a Let's Encrypt SSL certificate to the Proxmox web interface

Proxmox VE uses a self-signed certificate by default, so browsers warn on every login. The built-in ACME client can fetch a free Proxmox Let's Encrypt certificate and renew it automatically.

Before you start

• A hostname such as pve1.example.com with a DNS A record pointing to the node.
• For HTTP validation: port 80 on the node reachable from the internet during validation.
• For DNS validation (works without public port 80): an API token from a supported DNS provider.

Register an ACME account

1. Datacenter → ACME → Accounts → Add.
2. Enter an account name and an email for expiry notices, choose Let's Encrypt V2 and accept the terms.

Or from the shell:

pvenode acme account register default admin@example.com

Add a DNS plugin (only for DNS validation)

1. Datacenter → ACME → Challenge Plugins → Add.
2. Choose your DNS provider and enter the API credentials it requires.

Order the Proxmox Let's Encrypt certificate

1. Select the node → System → Certificates.
2. Under ACME, click Add, choose HTTP or DNS (with your plugin) and enter the domain.
3. Select the ACME account and click Order Certificates Now.
4. The web UI restarts with the new certificate; reload the page.

Check afterwards

• Open https://pve1.example.com:8006; the padlock shows a valid certificate.
• Check expiry with pvenode cert info.

Troubleshooting

• HTTP validation fails: port 80 blocked by the Proxmox or upstream firewall, or DNS points elsewhere.
• DNS validation timeout: wrong API token, or the provider is slow to publish; increase the validation delay in the plugin.
• Rate limit: too many failed attempts; wait and fix the cause before retrying.

Frequently asked questions

Does each cluster node need its own certificate?

Yes, order one per node hostname.

Can I upload my own certificate instead?

Yes, use Upload Custom Certificate on the same page.

Should I still restrict port 8006?

Yes. A valid certificate encrypts traffic but does not stop attackers trying to log in (firewall setup).

Next steps

• Proxmox firewall
• Users and 2FA
• Install Proxmox VE