Bug 1362222
| Summary: | vv file via ovirt-shell broken, bad url to ca.crt | ||
|---|---|---|---|
| Product: | [oVirt] ovirt-engine-cli | Reporter: | Jiri Belka <jbelka> |
| Component: | General | Assignee: | Ondra Machacek <omachace> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Jiri Belka <jbelka> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 3.6.8.0 | CC: | bugs, jbelka, juan.hernandez, mgoldboi, mperina, omachace, oourfali |
| Target Milestone: | ovirt-4.0.6 | Flags: | rule-engine:
ovirt-4.0.z+
mgoldboi: planning_ack+ juan.hernandez: devel_ack+ pstehlik: testing_ack+ |
| Target Release: | 3.6.9.1 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ovirt-engine-cli-3.6.9.1 | Doc Type: | Bug Fix |
| Doc Text: |
Cause:
oVirt 4.0 has removed ovirt-engine/ca.crt URL endpoint.
Consequence:
ovirt-shell can't obtain CA certificate, for spice console.
Fix:
ovirt-shell now connect addtionally to ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA, to obtain CA certificate
Result:
ovirt-shell can obtain CA certificate, for spice console.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-01-18 07:28:40 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | Infra | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Jiri Belka
2016-08-01 15:34:29 UTC
Ondra - can you take a look? The problem is inside the "download_ca_certificate" function inside the "spice.py" file of the CLI. It expects the "ca.crt" available in the root of the web server, but that has been removed from version 4 of the engine, without notice. I think we need to change the "download_ca_certificate" function so that it first tries to download it from "http://.../ovirt-engine/ca.crt". If that fails, for whatever the reason (older engine, for example(, then it should try to download it from "http://.../ovirt/engine/ca.crt". Note also that all the certificates that we create contain an "authorityInfoAccess" extension with the following value (see the engine "pki.py" source file): caIssuers;URI:http://.../ca.crt So one could argue that we should preserve the "ca.crt" available in that location, or else fix the process that generates the certificates, and maybe all the certificates themselves. Jiri, can you confirm that this happened when connecting to version 4 of the engine? There are two workarounds for this issue: 1. In the server side, in the engine machine, copy the /etc/pki/ovirt-engine/ca.pem file to /var/www/html/ca.crt: # openssl x509 -in /etc/pki/ovirt-engine/ca.pem -out /var/www/html/ca.crt This will work for all clients connecting to that server. 2. Copy the server /etc/pki/ovirt-engine/ca.pem file to the ~/.spicec/spice_truststore.pem file: $ mkdir -p ~/.spicec $ scp root.com:/etc/pki/ovirt-engine/ca.pem . $ openssl x509 -in /etc/pki/ovirt-engine/ca.pem -out ~/.spicec/spice_truststore.pem This works only for that server/client combination. Note that use of the "openssl x509" command instead of just "cp", that is necessary to strip the certificate text that may confuse the spice client. As there is a workaround I'm lowering the severity. (In reply to Juan Hernández from comment #4) > Jiri, can you confirm that this happened when connecting to version 4 of the > engine? > > There are two workarounds for this issue: > > 1. In the server side, in the engine machine, copy the > /etc/pki/ovirt-engine/ca.pem file to /var/www/html/ca.crt: > > # openssl x509 -in /etc/pki/ovirt-engine/ca.pem -out /var/www/html/ca.crt > > This will work for all clients connecting to that server. > > 2. Copy the server /etc/pki/ovirt-engine/ca.pem file to the > ~/.spicec/spice_truststore.pem file: > > $ mkdir -p ~/.spicec > $ scp root.com:/etc/pki/ovirt-engine/ca.pem . > $ openssl x509 -in /etc/pki/ovirt-engine/ca.pem -out > ~/.spicec/spice_truststore.pem > > This works only for that server/client combination. > > Note that use of the "openssl x509" command instead of just "cp", that is > necessary to strip the certificate text that may confuse the spice client. > > As there is a workaround I'm lowering the severity. Yes, it was: ovirt-engine-cli-3.6.8.1-1.el7ev.noarch ovirt-engine-4.0.2.7-0.1.el7ev.noarch and workarounds work fine. ok, ovirt master - ovirt-engine-cli-3.6.9.2-1.el7.centos.noarch |