Bug 1038304

Summary:	virsh -c qemu://session (missing slash) gives obscure error: Cannot read CA certificate '/etc/pki/CA/cacert.pem'
Product:	[Community] Virtualization Tools	Reporter:	Ray Strode [halfline] <rstrode>
Component:	libvirt	Assignee:	Libvirt Maintainers <libvirt-maint>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	berrange, clalancette, crobinso, itamar, jforbes, laine, libvirt-maint, rbalakri, veillard, virt-maint
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-04-19 21:53:26 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ray Strode [halfline] 2013-12-04 21:08:53 UTC

<mclasen> so, why does virt-manager refuse to connect to a session instance
<mclasen> with the words 'Cannot read CA certificate '/etc/pki/CA/cacert.pem' ?
<halfline> mclasen_: http://wiki.libvirt.org/page/TLSCreateCACert mentions mv cacert.pem /etc/pki/CA
<halfline> mclasen_: could it be you did qemu://localhost/session instead of qemu:///session ?
<mclasen_> I am clicking on a 'session (QEMU)
<mclasen_> ' in the virt-manager ui
<mclasen_> which claims to be qemu:///session
<halfline> okay crobinso might have a clue
<crobinso> mclasen_: where's the rest of the conversation?
<halfline> crobinso: we figured it out
<halfline> wrong number of slashes
<halfline> crobinso: if you do virt-manager -c qemu://session instead of virt-manager -c qemu:///session it gives a really confusing error message about TLS ca certificates
<crobinso> halfline: ah yeah, that's some libvirt weirdness that hits people on occasion. it should be fixable if someone wanted to file a bug

Comment 1 Cole Robinson 2013-12-04 21:19:23 UTC

To clarify a bit:

# virsh --connect qemu://session
error: failed to connect to the hypervisor
error: Cannot read CA certificate '/etc/pki/CA/cacert.pem': No such file or directory

There have been quite a few people over the years that have made a similar mistake and been completely confused by the error message, it would be nice to help them out: "are you missing a slash?" or something similar.

Comment 2 Cole Robinson 2016-04-18 23:04:59 UTC

I sent a patch upstream:

http://www.redhat.com/archives/libvir-list/2016-April/msg01169.html

Comment 3 Cole Robinson 2016-04-19 21:53:26 UTC

Upstream now:

commit 0d1579572a864c33621da4d01408f8bcb6de5d4a
Author: Cole Robinson <crobinso>
Date:   Sat Apr 16 08:59:08 2016 -0400

    Explicitly error on uri=qemu://system