Proxmox VE and Proxmox Backup Server install a self-signed certificate that your device cannot verify on its own. Aprox never skips the check silently. Instead, it shows you the certificate's fingerprint once, you compare it with the server, and Aprox then accepts exactly that certificate from then on. This is called pinning: it works with self-signed certificates and still protects you against someone intercepting the connection.

If your server uses a certificate from a public certificate authority, for example through ACME, your device trusts it already and you never see a prompt.

Where to find it

  • The trust prompt appears the first time Aprox contacts the server: when you sign in, or when you tap Refresh realms from server in the server editor.
  • While a server waits for you to trust its certificate, the sidebar shows an orange lock and the row Certificate not trusted ("Open to review the fingerprint") under the server. Tap that row to see the prompt.
  • The pinned certificate is shown in the server editor under Security › Trusted certificate.

Trust a certificate

  1. Sign in to the server, or tap Refresh realms from server in the editor.
  2. Aprox shows: "This server uses a certificate your device cannot verify. Check the fingerprint below against the server before trusting it." with the certificate's Subject and its SHA-256 fingerprint.
  3. Look up the fingerprint on the server:
    • Proxmox VE web interface: select the node › System › Certificates and view the certificate that is in use.
    • Proxmox VE shell: run pvenode cert info on the node.
    • Proxmox Backup Server: open Show Fingerprint on the dashboard of the web interface, or run proxmox-backup-manager cert info.
  4. Compare the two fingerprints. They must match exactly.
  5. Tap Trust This Certificate.

Aprox pins the certificate and continues signing in. From now on, it accepts only this exact certificate for this server.

To stop instead, tap Cancel on the sign-in screen.

When the certificate changes

If the server presents a different certificate than the one you pinned, Aprox stops and shows, in red: "This server presented a different certificate than the one you trusted. If you did not just replace it, do not continue."

This happens after you renew or replace the certificate on the server. It is also exactly what an interception of the connection would look like.

  1. If you did not change the certificate yourself, do not continue. Check the network you are on.
  2. If you renewed it yourself, compare the new fingerprint with the server as described above.
  3. Tap Trust the New Certificate only if the fingerprints match.

Forget a pinned certificate

  1. Long-press or right-click the server in the sidebar and choose Edit (Android: Edit Server).
  2. Under Security, tap Forget trusted certificate.
  3. Tap Save.

The next connection shows the trust prompt again.

Skip TLS validation

The server editor has a Skip TLS validation switch under Security. It turns certificate checking off completely.

Warning

With Skip TLS validation on, the server's certificate is not checked at all. Anyone able to intercept the connection can read your password, your API tickets and everything you do on this server. Trusting the certificate once by fingerprint is the better choice and still works with a self-signed certificate.

  • Leave the switch off unless you have a specific reason.
  • A pinned certificate always takes precedence. Trusting a certificate also turns Skip TLS validation off.
  • Consoles can stay blank when the certificate is merely skipped. Pin it instead.

If no certificate can be read

If Aprox shows "The secure connection to this server failed and no certificate could be read. Check the host and port.", the connection failed before the server presented a certificate. Usually the port is wrong (8006 for Proxmox VE, 8007 for Backup Server), or the address does not point to an HTTPS Proxmox endpoint.