-|nodes/<NAME>/pve-ssl.pem | public ssl key for web server
-|nodes/<NAME>/priv/pve-ssl.key | private ssl key
+|priv/pve-root-ca.key | private key of cluster CA
+|nodes/<NAME>/pve-ssl.pem | public ssl certificate for web server (signed by cluster CA)
+|nodes/<NAME>/pve-ssl.key | private ssl key for pve-ssl.pem
+|nodes/<NAME>/pveproxy-ssl.pem | public ssl certificate (chain) for web server (optional override for pve-ssl.pem)
+|nodes/<NAME>/pveproxy-ssl.key | private ssl key for pveproxy-ssl.pem (optional)