Red Hat Bugzilla – Bug 1140152
Keystone LDAPS connection using CA certificate
Last modified: 2018-02-08 05:22:26 EST
This is a valid bug, but it should also be possible to configure the CA certificate trust at the OpenLDAP library level on the Keystone system. In the '/etc/openldap/ldap.conf' config file, the directory that contains trusted CA certificates is set in the TLS_CACERTDIR setting (which defaults to '/etc/openldap/certs'). There is a NSS database in here, where the certificate can be imported and trusted using the 'certutil' utility. Has this approach been attempted?
(In reply to Nathan Kinder from comment #2) > This is a valid bug, but it should also be possible to configure the CA > certificate trust at the OpenLDAP library level on the Keystone system. > > In the '/etc/openldap/ldap.conf' config file, the directory that contains > trusted CA certificates is set in the TLS_CACERTDIR setting (which defaults > to '/etc/openldap/certs'). There is a NSS database in here, where the > certificate can be imported and trusted using the 'certutil' utility. Has > this approach been attempted? Are you referring to the procedure listed in: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform/5/html/Cloud_Administrator_Guide/configuring-keystone-for-ldap-backend.html#configuring-keystone-for-ldap-backend-harden Does the following import the CA to the keystore (or is that an additional step). # openstack-config --set /etc/keystone/keystone.conf ldap tls_cacertfile CA_FILE
(In reply to Eric Rich from comment #3) > (In reply to Nathan Kinder from comment #2) > > Are you referring to the procedure listed in: > https://access.redhat.com/documentation/en-US/ > Red_Hat_Enterprise_Linux_OpenStack_Platform/5/html/Cloud_Administrator_Guide/ > configuring-keystone-for-ldap-backend.html#configuring-keystone-for-ldap- > backend-harden No, this is a separate procedure. > > Does the following import the CA to the keystore (or is that an additional > step). > > # openstack-config --set /etc/keystone/keystone.conf ldap tls_cacertfile > CA_FILE No, this does not import the certificate into the NSS database. This command simply edits keystone.conf to add: ------------------------------ [ldap] ... tls_cacertfile = <CA_FILE> ... ------------------------------ The procedure I mentioned previously is configuring the LDAP libraries on the system to trust a CA cert, which applies for anything using the LDAP libraries (including Keystone).
*** Bug 1140819 has been marked as a duplicate of this bug. ***
Comment #5 is about a different issue (bug 1058484). Let's keep the conversation separate from this issue related to CA certificate trust.
There are two ways of configuring the CA trust for the OpenLDAP libraries that are used by Keystone: Method 1: --------- 1 - Copy the file containing your CA certificate chain (in PEM format) to /etc/openldap/certs. 2 - Edit /etc/openldap/ldap.conf and add the following directive: TLS_CACERT /etc/openldap/certs/<ca file> Be sure to replace <ca file> with the filename that was chosen for your CA certificate chain. Method 2: --------- 1 - Use certutil to import and trust your CA certificate chain into the NSS certificate database that is used by the OpenLDAP client libraries: certutil -d /etc/openldap/certs -A -n "My CA" -t CT,, -a -i <ca file> Be sure to replace <ca file> with the filename that was chosen for your CA certificate chain. You can use a more appropriate certificate nickname for the '-n' option. This nickname is used to identity the certificate in the NSS database. 2 - Confirm that the CA certificate was imported correctly: certutil -d /etc/openldap/certs -L Your CA certificate should be listed, and the trust attributes should be set to "CT,,".
One more note to add to comment#8 is that the Keystone service needs to be restarted for the changes to take effect.
A fix for this has been submitted upstream (for master - Juno): https://review.openstack.org/#/c/120954/
An upstream backport request for stable/icehouse has been submitted here: https://review.openstack.org/120959
This was addressed in the upstream 2014.1.3 release.
Verified in: openstack-keystone-2014.1.3-2.el7ost.noarch python-keystone-2014.1.3-2.el7ost.noarch
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2014-1790.html