Description of problem: In this environment, keystone is integrated with active directory via LDAPS. The LDAP servers are still using 1024 bit SSL keys which require the crypto policy to be set to LEGACY. The following errors occur in the keystone.log with the DEFAULT crypto policy: "Verification error: EE certificate key too weak" A temporary work-around: # sudo podman exec keystone update-crypto-policies --set LEGACY # sudo systemctl restart tripleo_keystone # sudo podman exec keystone update-crypto-policies --show LEGACY However, this is reverted after overcloud deployment. Another more permanent work-around: sudo update-crypto-policies --set LEGACY sudo cp -fR /etc/crypto-policies /var/lib/config-data/puppet-generated/keystone/etc/ sudo systemctl restart tripleo_keystone OSP Director should support changing containers' crypto policy or at least inherit the system's current policy during container startup. Version-Release number of selected component (if applicable): 16.1 How reproducible: 100% Steps to Reproduce: 1.see above
Additional info for the work-around: ~~~ On QA, we did the following steps and it still didn't get LDAPS login working sudo podman exec -ti keystone update-crypto-policies --set LEGACY sudo podman restart keystone Then I ended up doing the below step as well and got it working commented out the following line from /etc/openldap/ldap.conf. TLS_CACERTDIR /etc/openldap/cacerts ~~~