RDO tickets are now tracked in Jira https://issues.redhat.com/projects/RDO/issues/
Bug 1080496 - Unhelpful error message when keystone uses self-signed SSL certificates
Summary: Unhelpful error message when keystone uses self-signed SSL certificates
Keywords:
Status: CLOSED UPSTREAM
Alias: None
Product: RDO
Classification: Community
Component: python-keystoneclient
Version: unspecified
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: ---
Assignee: Jamie Lennox
QA Contact: Ami Jeain
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-03-25 14:34 UTC by Udi Kalifon
Modified: 2016-04-26 13:47 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2015-03-25 00:53:19 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Launchpad 1297280 0 None None None Never

Description Udi Kalifon 2014-03-25 14:34:50 UTC
Duplicating upstream bug https://bugs.launchpad.net/python-keystoneclient/+bug/1297280

When keystone is configured to use SSL and its certificates are not signed by a trusted authority, all the keystone client commands return:

Authorization Failed: SSL exception connecting to https://127.0.0.1:35357/v2.0/tokens

It would be better to instruct the user to pass the "--insecure" command-line option to the keystone command.

I set up my keystone with SSL like this:
1) Uncomment the following lines in keystone.conf:
[ssl]
enable = True
certfile = /etc/keystone/pki/certs/ssl_cert.pem
keyfile = /etc/keystone/pki/private/ssl_key.pem
ca_certs = /etc/keystone/pki/certs/cacert.pem
ca_key = /etc/keystone/pki/private/cakey.pem

2) Run 'keystone-manage ssl_setup --keystone-user keystone --keystone-group keystone' and restart the service

3) Change the endpoints in the SQL table to point to https://...

To get the error, source the following file (change the username and password, and make sure the endpoint correctly points to https://...):
export OS_USERNAME=admin
export OS_TENANT_NAME=admin
export OS_PASSWORD=18ee8218fe2d4e6e
export OS_AUTH_URL=https://127.0.0.1:35357/v2.0/

Now run: keystone user-list
You get: Authorization Failed: SSL exception connecting to https://127.0.0.1:35357/v2.0/tokens
You are supposed to run: keystone --insecure user-list

It's really hard to tell by this error message what the cause of the problems is. In addition to that, there is nothing in the keystone logs. Please provide a more informative error message, and possibly some logs to indicate what went wrong.

Comment 1 Rob Crittenden 2014-04-01 20:45:57 UTC
It would be nice if the Keystone CA were added to the system CA list via something like http://fedoraproject.org/wiki/Features/SharedSystemCertificates

Comment 2 Adam Young 2014-06-03 20:52:19 UTC
Use the --os-cacert <ca-certificate> flag, not --insecure

Comment 3 Lars Kellogg-Stedman 2015-03-25 00:53:19 UTC
The original problem was fixed upstream in https://review.openstack.org/#/c/129769/.  With that change, keystone will now return a more useful error message in the event that certificate validation fails.


Note You need to log in before you can comment on or make changes to this bug.