Created attachment 1148986 [details]
The virt-viewer cmdline debug info

Description of problem:
As subject

Version-Release number of selected component (if applicable):
libvirt-1.3.3-2.el7.x86_64
qemu-kvm-rhev-2.5.0-4.el7.x86_64
spice-server-0.12.4-15.el7.x86_64
spice-gtk-0.26-8.el7.x86_64
spice-glib-0.26-8.el7.x86_64

How reproducible:
100%


Steps to Reproduce:
1. Prepare spice ssl env:
Change /etc/libvirt/qemu.conf to:
spice_listen = "0.0.0.0"
spice_tls = 1
spice_tls_x509_cert_dir = "/etc/pki/libvirt-spice"

Running following script to generate keys for spice-ssl and restart libvirtd service:
#!/bin/bash
SERVER_KEY=server-key.pem
# creating a key for our ca
if [ ! -e ca-key.pem ]; then
openssl genrsa -des3 -out ca-key.pem 1024
fi
# creating a ca
if [ ! -e ca-cert.pem ]; then
openssl req -new -x509 -days 1095 -key ca-key.pem -out ca-cert.pem -subj "/C=IL/L=Raanana/O=Red Hat/CN=my CA"
fi
# create server key
if [ ! -e $SERVER_KEY ]; then
openssl genrsa -out $SERVER_KEY 1024
fi
# create a certificate signing request (csr)
if [ ! -e server-key.csr ]; then
openssl req -new -key $SERVER_KEY -out server-key.csr -subj "/C=IL/L=Raanana/O=Red Hat/CN=my server"
fi
# signing our server certificate with this ca
if [ ! -e server-cert.pem ]; then
openssl x509 -req -days 1095 -in server-key.csr -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem
fi
# now create a key that doesn't require a passphrase
openssl rsa -in $SERVER_KEY -out $SERVER_KEY.insecure
mv $SERVER_KEY $SERVER_KEY.secure
mv $SERVER_KEY.insecure $SERVER_KEY
# show the results (no other effect)
openssl rsa -noout -text -in $SERVER_KEY
openssl rsa -noout -text -in ca-key.pem
openssl req -noout -text -in server-key.csr
openssl x509 -noout -text -in server-cert.pem
openssl x509 -noout -text -in ca-cert.pem
# copy *.pem file to /etc/pki/libvirt-spice
if [[ -d "/etc/pki/libvirt-spice" ]]
then
cp ./*.pem /etc/pki/libvirt-spice
else
mkdir /etc/pki/libvirt-spice
cp ./*.pem /etc/pki/libvirt-spice
fi
# echo --host-subject
echo "your --host-subject is" \" `openssl x509 -noout -text -in server-cert.pem | grep Subject: | cut -f 10- -d " "` \"
service libvirtd restart

Start a guest with following xml:
<graphics type='spice' autoport='yes'>
 <listen type='address' address='0.0.0.0'/>
<channel name='main' mode='secure'/>
</graphics>

# virsh list
 Id    Name                           State
----------------------------------------------------
 16    spice-13199                    running

2. connect spice with virt-viewer:
# virt-viewer spice-13199 --spice-host-subject="C=IL,L=Raanana,O=Red Hat,CN=my server" --spice-ca-file='/etc/pki/libvirt-spice/ca-cert.pem' --spice-debug --debug -v > spice.log
The virt-viewer shows 'connecting server' but not show the guest screen.

Actual results:
As step2

Expected results:
Connected to guest and ok to use.

Additional info:
1.When I delete <channel name='main' mode='secure'/> , xml as following:
<graphics type='spice' autoport='yes'>
 <listen type='address' address='0.0.0.0'/>
</graphics>
Spice is ok to use.
2. When I downgrade spice-gtk component to 0.26-5.el7, it is ok. The versions(0.26-6.el7~0.26-8.el7) higher than 0.26-5.el7 all have the bug. Maybe it is a regression of spice-gtk.