if the files pveproxy-ssl.pem and pveproxy-ssl.key are
available for a node (i.e., in /etc/pve/<node>/), they will
be used as TLS certificate and private key for the web
interface and API of this node.
Note: the Spice and non-websocket VNC connections are still
using the self-signed certificate and key in pve-ssl.pem
and pve-ssl.key.
If set, Diffie-Hellman parameters in PEM format are loaded
from the given path. Otherwise, the built-in 'skip2048'
group is used.
Also fix some typos in the man page.
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
AnyEvent uses a built-in DH group defined as 'schmorp1539'
by default, which seems to trigger the bug in [1] for every
attempt of accessing the web GUI using IE11 and TLS1.2. By
switching to a bigger default DH group ('skip2048'), the
bug seems to be gone (or trigger sufficiently rarely).
1: http://engineering.imvu.com/2015/01/27/the-case-of-the-page-cant-be-displayed-intermittent-selenium-test/
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
As we, for now, default to exclude ext5 from our build it's better
to make an check if its directory exists, and only then allow to
load from it. Else we can get errors on proxy startup, and when
someone passes the ext5 parameter.
Also make a indent/whitespace cleanup.
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
