Bug 1300452

Description of problem:
Simple undercloud installation with a very basic certificate does succeed (and then there are warnings BZ#1242675)

Trying to create an SSL certificate where the address of the host and endpoints is in the subjectAltNames field and not in the CN, as per the RFC, doesn't go through at all. After the deployment fails, the logs show none of the https endpoints actually up and working.

Version-Release number of selected component (if applicable):
tested on 2016-01-18.3 and Y2 2015-12-16.1 

How reproducible:
always

Steps to Reproduce:
sudo yum -y install crudini
sudo crudini --set /etc/pki/tls/openssl.cnf " alternate_names " DNS.1 instack.localdomain
sudo crudini --set /etc/pki/tls/openssl.cnf " alternate_names " DNS.2 instack
sudo crudini --set /etc/pki/tls/openssl.cnf " alternate_names "  DNS.3 192.0.2.2
sudo crudini --set /etc/pki/tls/openssl.cnf " alternate_names "  DNS.4 192.0.2.1
sudo crudini --set /etc/pki/tls/openssl.cnf " alternate_names " IP.1 192.0.2.2sudo crudini --set /etc/pki/tls/openssl.cnf " alternate_names " IP.2 192.0.2.1
sudo crudini --set /etc/pki/tls/openssl.cnf " v3_ca " subjectAltName "@alternate_names"
sudo crudini --set /etc/pki/tls/openssl.cnf " v3_ca " keyUsage "digitalSignature, keyEncipherment"
sudo crudini --set /etc/pki/tls/openssl.cnf " CA_default " copy_extensions copy
openssl genrsa -out /home/stack/privkey.pem 2048
openssl req -new -x509 -key privkey.pem -out cacert.pem -days 365 -subj "/C=CA/ST=GTA/L=Toronto/O=Red HAt/OU=QE/CN=Underclouds R Us" && cat cacert.pem privkey.pem > undercloud.pem
sudo mkdir /etc/pki/instack-certs
sudo cp ~/undercloud.pem /etc/pki/instack-certs/ && sudo semanage fcontext -a -t etc_t "/etc/pki/instack-certs(/.*)?" && sudo restorecon -R /etc/pki/instack-certs
cp /usr/share/instack-undercloud/undercloud.conf.sample /home/stack/undercloud.conf
sed -i -e "s#.*undercloud_service_certificate.*#undercloud_service_certificate = /etc/pki/instack-certs/undercloud.pem#" /home/stack/undercloud.conf

openstack undercloud install

Actual results:
deployment fails when it cannot reach keystone over https on port 13000.

Expected results:
deployment should go through using these certificates

Additional info:
Tested deploy with UC without SSL and using the same technique to generate the OC certificates, which also failed on timeout connecting to endpoints.

All tests done in a virt env