How to Manually Change the VSA Host Management Certificate
| KB ID: | 4813 |
| Product: | Veeam Backup & Replication | 13 |
| Published: | 2026-01-15 |
| Last Modified: | 2026-01-15 |
Oops! Something went wrong.
Please, try again later.
Purpose
This article documents the procedure for updating the Host Management Certificate used by the VSA (Veeam Software Appliance).
Note: The ability to update the certificate via the VSA Host Management Console may be added in a future version; however, as of version 13.0, it must be completed by accessing and executing native shell commands.
Solution
Part 1: Requirements of the New Certificate files
- The new certificate must be available in .crt (certificate) and .key (private key) format.
- The new certificate files must be named:
- veeam_hostmanager_nginx_certificate.crt
- veeam_hostmanager_nginx_certificate.key
Part 2: Enable SSH Shell Access
Access the Veeam Host Management Console and enable the SSH Server.
Note: If the Veeam Security Officer role is enabled, the Security Officer must approve the request to enable the SSH Server.
Part 3: Copy the new Certificate Files to the VSA
Using SCP, or an SCP application of your choice, copy the new veeam_hostmanager_nginx_certificate.crt and veeam_hostmanager_nginx_certificate.key files to the Veeam Software Appliance.
Note: Due to the limited permissions of the user account used to connect to the VSA, you must initially copy the certificate files to the user's home directory.
Example scp command:
In this example, the default admin account, veeamadmin, is used. The command may need to be updated to specify the user you wish to use and hostname with the DNS name of the server or the actual IP address of the Veeam Software Appliance.
Note: The : at the end results in the files being uploaded to the home folder of the user.
Part 4: Replace the Existing Certificate Files, Restart nginx, and Cleanup
With the certificate files now copied to the Veeam Software Appliance, the next steps are to replace the existing certificate files and restart the nginx service.
Note: Replacing the certificate files and restarting the nginx service requires root access, which can only be achieved using the Terminal UI. This requires a physical console or a virtual remote console. The Veeam Host Management TUI cannot be accessed through SSH.
- Connect to the Terminal UI and access the root Shell.
- Navigate to the folder where the new .crt and .key files were uploaded.
- Copy the new certificate files to
/etc/veeam/certs/nginx/, overwriting the existing certificate files.
Example command:
- Restart the web server to apply the new certificate:
- Connect to the Host Management console via a web browser to verify that the new certificate is in use and trusted.
- Cleanup the uploaded certificate files from the home directory:
If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
