Bug 1533805

I'm kind of failing to see how this is a libvirt issue, does a simple TLS connection to libvirtd work without any issues for you? Also, try running virt-viewer with --gtk-vnc-debug and if the problem are indeed certificates, then rerun with only GNUTLS_DEBUG_LEVEL=2 set (to filter out the rest of the logs for readability) and post the output.

(In reply to Erik Skultety from comment #2)
> I'm kind of failing to see how this is a libvirt issue, does a simple TLS
> connection to libvirtd work without any issues for you? Also, try running
> virt-viewer with --gtk-vnc-debug and if the problem are indeed certificates,
> then rerun with only GNUTLS_DEBUG_LEVEL=2 set (to filter out the rest of the
> logs for readability) and post the output.

1) A simple TLS conection to libvirtd works
   # virt-viewer -c qemu+tls://fjin-4-179/system

2) Check the attachment for the output of "virt-viewer with --gtk-vnc-debug"

Created attachment 1389599 [details]
virt-viewer --gtk-vnc-debug

(In reply to Erik Skultety from comment #2)
> I'm kind of failing to see how this is a libvirt issue, does a simple TLS
> connection to libvirtd work without any issues for you? Also, try running
> virt-viewer with --gtk-vnc-debug and if the problem are indeed certificates,
> then rerun with only GNUTLS_DEBUG_LEVEL=2 set (to filter out the rest of the
> logs for readability) and post the output.

Maybe it is virt-viewer issue

(In reply to Fangge Jin from comment #4)
> Created attachment 1389599 [details]
> virt-viewer --gtk-vnc-debug

gnutls[2]: crt_is_known: did not find cert, using issuer DN + serial, using DN only
gnutls[2]: crt_is_known: did not find any cert
gnutls[2]: crt_is_known: did not find cert, using issuer DN + serial, using DN only
gnutls[2]: crt_is_known: did not find any cert
(virt-viewer:21143): gtk-vnc-DEBUG: vncconnection.c Error: The certificate is not trusted

...There you go, you have problems with your certificates, I'd suggest using certtool to validate your client certificate, if it fails you know where the problem is...I tried with virt-manager and it failed identically when I followed the steps in your test case. There might be a bug in gnutls, but very likely the problem is with your certificates.

(In reply to Erik Skultety from comment #6)
> (In reply to Fangge Jin from comment #4)
> > Created attachment 1389599 [details]
> > virt-viewer --gtk-vnc-debug
> 
> gnutls[2]: crt_is_known: did not find cert, using issuer DN + serial, using
> DN only
> gnutls[2]: crt_is_known: did not find any cert
> gnutls[2]: crt_is_known: did not find cert, using issuer DN + serial, using
> DN only
> gnutls[2]: crt_is_known: did not find any cert
> (virt-viewer:21143): gtk-vnc-DEBUG: vncconnection.c Error: The certificate
> is not trusted
> 
> ...There you go, you have problems with your certificates, I'd suggest using
> certtool to validate your client certificate, if it fails you know where the
> problem is...I tried with virt-manager and it failed identically when I
> followed the steps in your test case. There might be a bug in gnutls, but
> very likely the problem is with your certificates.

I don't know what's wrong about my certificates, I have all the certs needed and validated against the CA cert:

# ll /etc/pki/libvirt
total 8
-rw-r--r--. 1 root root 741 Jan 10 18:53 clientcert.pem
drwxr-xr-x. 2 root root  48 Nov 10 17:53 private
-rw-r--r--. 1 root root 741 Jan 10 18:46 servercert.pem


# ll /etc/pki/libvirt/private/
total 8
-rw-r--r--. 1 root root 891 Jan 10 18:53 clientkey.pem
-rw-r--r--. 1 root root 887 Jan 10 18:46 serverkey.pem

# ll /etc/pki/libvirt-vnc/
total 0
lrwxrwxrwx. 1 root root 22 Jan 12 17:21 ca-cert.pem -> /etc/pki/CA/cacert.pem
lrwxrwxrwx. 1 root root 29 Jan 12 17:20 ca-key.pem -> /etc/pki/CA/private/cakey.pem
lrwxrwxrwx. 1 root root 31 Jan 12 17:36 client-cert.pem -> /etc/pki/libvirt/clientcert.pem
lrwxrwxrwx. 1 root root 38 Jan 12 17:37 client-key.pem -> /etc/pki/libvirt/private/clientkey.pem
lrwxrwxrwx. 1 root root 31 Jan 12 17:26 server-cert.pem -> /etc/pki/libvirt/servercert.pem
lrwxrwxrwx. 1 root root 38 Jan 12 17:27 server-key.pem -> /etc/pki/libvirt/private/serverkey.pem


# ll /etc/pki/CA/
total 4
-rw-r--r--. 1 root root 863 Jan 12 17:04 cacert.pem
drwxr-xr-x. 2 root root   6 Dec  6 16:35 certs
drwxr-xr-x. 2 root root   6 Dec  6 16:35 crl
drwxr-xr-x. 2 root root   6 Dec  6 16:35 newcerts
drwx------. 2 root root  23 Jan 12 17:16 private


# ll /etc/pki/CA/private/
total 4
-rw-r--r--. 1 root root 963 Jan 12 17:05 cakey.pem


# openssl verify -verbose -CAfile /etc/pki/CA/cacert.pem /etc/pki/libvirt/servercert.pem
/etc/pki/libvirt/servercert.pem: OK

# openssl verify -verbose -CAfile /etc/pki/CA/cacert.pem /etc/pki/libvirt/clientcert.pem 
/etc/pki/libvirt/clientcert.pem: OK

Not sure how gtk-vnc handles CA, spice has extra command line options but... 

> (virt-viewer:21143): gtk-vnc-DEBUG: vncconnection.c Do TLS handshake
> (virt-viewer:21143): gtk-vnc-DEBUG: vncconnection.c No CA certificate provided; trying the system trust store instead

... seems to tell me that it is checking system wide CA, not sure if the paths above are included in the check.

Could you please confirm you still have this issue?

This bug doesn't report the original gtk-vnc version, but given the date of the report, I expect is is probably a dupe of this GTK-VNC flaw: https://bugzilla.redhat.com/show_bug.cgi?id=1539148

Ah, many thanks Daniel.
I'm closing as DUP for now, please reopen if this is not fixed with gtk-vnc-0.7.0-3.el7 or above.

*** This bug has been marked as a duplicate of bug 1539148 ***