Hi Eugen, that worked! ceph config-key get mgr/dashboard/cephmon1/crt ceph config-key get mgr/dashboard/cephmon1/key ceph config-key rm mgr/dashboard/crt ceph config-key rm mgr/dashboard/key ceph dashboard set-ssl-certificate -i cephmon.science.ru.nl.pem
failed! ceph mgr module disable dashboard ceph dashboard set-ssl-certificate -i cephmon.science.ru.nl.pem failed! ceph mgr module enable dashboard ceph dashboard set-ssl-certificate -i cephmon.science.ru.nl.pem ceph dashboard set-ssl-certificate-key -i cephmon.science.ru.nl.key
Then it worked again :-) Cheers, /Simon On Mon, 27 Jul 2026 at 13:11, Eugen Block via ceph-users <ceph-users@ceph.io> wrote:
Hi,
the dashboard cert and key files are stored in:
ceph config-key get mgr/dashboard/crt ceph config-key get mgr/dashboard/key
Or something similar, maybe per host entries like (the "random" string is cephadm specific and won't apply in your case, of course):
ceph config-key get mgr/dashboard/host1.random/crt ceph config-key get mgr/dashboard/host1.random/key
You should be able to remove those faulty entries with
ceph config-key rm mgr/dashboard/host1.random/crt ceph config-key rm mgr/dashboard/host1.random/key
Then fail the mgr and inject your correct cert/key files again. I think that should work, if not, let us know.
Regards, Eugen
Zitat von Simon Oosthoek via ceph-users <ceph-users@ceph.io>:
Sorry, forgot to add info about the installation; this is ceph 17.2.x on ubuntu 22.04.x, no cephadm and the cluster has about 360 OSDs of 12TB HDD.
On Mon, 27 Jul 2026 at 11:50, Simon Oosthoek via ceph-users < ceph-users@ceph.io> wrote:
Hi all, we've had some issues when Harica revoked a bunch of our certificates, I then accidentally uploaded mismatching key/pem files. When I wanted to fix that with the correct ones I got
# ceph dashboard set-ssl-certificate -i cephmon.science.ru.nl.pem Error EIO: Module 'dashboard' has experienced an error and cannot handle commands: [('x509 certificate routines', '', 'key values mismatch')]
Is there another way to fix this?
Cheers,
/Simon -- I'm using my gmail.com address, because the gmail.com dmarc policy is "none", some mail servers will reject this (microsoft?) others will instead allow this when I send mail to a mailling list which has not yet been configured to send mail "on behalf of" the sender, but rather do a kind of "forward". The latter situation causes dkim/dmarc failures and the dmarc policy will be applied. see https://wiki.list.org/DEV/DMARC for more details _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
-- I'm using my gmail.com address, because the gmail.com dmarc policy is "none", some mail servers will reject this (microsoft?) others will instead allow this when I send mail to a mailling list which has not yet been configured to send mail "on behalf of" the sender, but rather do a kind of "forward". The latter situation causes dkim/dmarc failures and the dmarc policy will be applied. see https://wiki.list.org/DEV/DMARC for more details _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io
-- I'm using my gmail.com address, because the gmail.com dmarc policy is "none", some mail servers will reject this (microsoft?) others will instead allow this when I send mail to a mailling list which has not yet been configured to send mail "on behalf of" the sender, but rather do a kind of "forward". The latter situation causes dkim/dmarc failures and the dmarc policy will be applied. see https://wiki.list.org/DEV/DMARC for more details