# Fix missing web console service certificate

> Learn how to diagnose and resolve missing SSL certificates in the NoVNC console service. This guide explains why the NoVNC proxy service cannot establish secure connections and how to restore the required certificate file.

## Summary {#summary}

When the NoVNC console service cannot find its SSL certificate file at `/var/lib/nova/certs/server.pem`, the console tab opens but immediately fails with a connection refused error. The novnc_proxy service appears running despite the missing certificate preventing secure connections to virtual machine consoles.

## Details {#details}

### Issues description {#issues-description}

Fresh CubeCOS installations may experience console connectivity failures. When users create a virtual machine and attempt to open the console through the web interface, the new console tab opens, but the connection fails immediately.

The novnc_proxy service appears active and running without visible errors in the status output. However, examining the `/var/log/nova-novncproxy.log` service logs reveals that other CubeCOS nodes cannot find the required SSL certificate file at `/var/lib/nova/certs/server.pem`.

```log title="Error presentation in nova-novncproxy.log"
INFO nova.console.websocketproxy [-] xxx.xxx.xxx.xxx: SSL connection but '/var/lib/nova/certs/server.pem' not found
```

Without this certificate, the novnc_proxy service cannot establish secure connections when users attempt to access the console.

### Applicable versions {#applicable-versions}

CubeCOS 3.0.0+

This article applies to environments running CubeCOS version 3.0.0.

## Resolution {#resolution}

1. Copy the system certificate to the novnc directory. Run the following command:

   ```shell
   cubectl node exec cp /var/www/certs/server.pem /var/lib/nova/certs/server.pem
   ```

2. Restart the console proxy service by running the following command:

   ```shell
   cubectl node exec service openstack-nova-novncproxy restart
   ```

3. Confirm the service is running. Run the following command:

   ```shell
   cubectl node exec service openstack-nova-novncproxy status
   ```

   The output should show `active (running)`.

4. Attempt console connection through the web interface to verify function.

## Additional information {#additional-information}

None.