I tried changing the IncusOS server certificate from a incus client (linux) that is connected to IncusOS as the default remote.
I tried $ incus admin update-certificate foo incusos.crt incusos.key with “foo” being my IncusOS remote name. But I got an error Error: too many arguments; unexpected “incusos.key” and the explanation indicating that only two arguments <cert.crt> <cert.key> are supported. But the documentation says you can specify the remote too.
I then tried leaving the remote name out because IncusOS is selected as the default remote. That command succeeded with Successfully updated server certificate, but the IncusOS certificate was not changed, it still shows as “Linux Containers” certificate.
Is my syntax wrong? And what certificate did I change with leaving the remote name out?
The documented syntax requires the colon after the remote name: incus admin update-certificate [<remote>:] <cert.crt> <cert.key>. Use foo: rather than foo for the remote argument. The command also documents --explain, which explains the parsed arguments instead of performing a valid command. For the run you already made without a remote, incus remote get-default shows the default in the current shell, but that alone doesn’t establish which certificate the earlier run changed. I would verify the target before running the certificate update again.
Correction, 31 October 2026: this answer assumes remote syntax that the 7.5.1 client does not support, and the default-remote check does not apply to this command in that version. See post 4 below.
Thank you for your answer, but adding the colon (foo:) does not change anything. I still get the same error. And adding “–explain” shows the remote name gets associated with <cert.crt> and that leads to “too many arguments” then.
You’re right; my earlier answer used the current documentation without checking the command against your 7.5.1 client. Sorry about that. In the 7.5.1 source, update-certificate accepts only cert.crt and cert.key and connects through the local Unix socket. That explains why adding foo: still gives you an extra-argument error, and means the successful invocation targeted the local Incus daemon rather than the remote named foo. The 7.6.0 client source adds remote support; the server running 7.6 doesn’t give that syntax to a 7.5.1 client. My earlier suggestion to infer the target from the default remote was therefore not applicable to this command in your version.
Ah, that makes sense. The 7.6 changelog says incus/admin: Support remotes in update-certificate. I will wait then until my distros incus package gets updated. Thank you!