Hi, the dashboard cert and key files are stored in: ceph config-key get mgr/dashboard/crt ceph config-key get mgr/dashboard/key Or something similar, maybe per host entries like (the "random" string is cephadm specific and won't apply in your case, of course): ceph config-key get mgr/dashboard/host1.random/crt ceph config-key get mgr/dashboard/host1.random/key You should be able to remove those faulty entries with ceph config-key rm mgr/dashboard/host1.random/crt ceph config-key rm mgr/dashboard/host1.random/key Then fail the mgr and inject your correct cert/key files again. I think that should work, if not, let us know. Regards, Eugen Zitat von Simon Oosthoek via ceph-users <ceph-users@ceph.io>:

Sorry, forgot to add info about the installation; this is ceph 17.2.x on ubuntu 22.04.x, no cephadm and the cluster has about 360 OSDs of 12TB HDD.

On Mon, 27 Jul 2026 at 11:50, Simon Oosthoek via ceph-users < ceph-users@ceph.io> wrote:

...

Hi all, we've had some issues when Harica revoked a bunch of our certificates, I then accidentally uploaded mismatching key/pem files. When I wanted to fix that with the correct ones I got

# ceph dashboard set-ssl-certificate -i cephmon.science.ru.nl.pem Error EIO: Module 'dashboard' has experienced an error and cannot handle commands: [('x509 certificate routines', '', 'key values mismatch')]

Is there another way to fix this?

Cheers,

/Simon -- I'm using my gmail.com address, because the gmail.com dmarc policy is "none", some mail servers will reject this (microsoft?) others will instead allow this when I send mail to a mailling list which has not yet been configured to send mail "on behalf of" the sender, but rather do a kind of "forward". The latter situation causes dkim/dmarc failures and the dmarc policy will be applied. see https://wiki.list.org/DEV/DMARC for more details _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io

-- I'm using my gmail.com address, because the gmail.com dmarc policy is "none", some mail servers will reject this (microsoft?) others will instead allow this when I send mail to a mailling list which has not yet been configured to send mail "on behalf of" the sender, but rather do a kind of "forward". The latter situation causes dkim/dmarc failures and the dmarc policy will be applied. see https://wiki.list.org/DEV/DMARC for more details _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io