Description of problem: Cumin doesn't allow to set CA_DIR for multiple CA cert files for SSL connection with multiple condor-aviary hosts (e.g. different job server and query server). - condor-aviary has similar options: SCHEDD.AVIARY_SSL_CA_DIR = QUERY_SERVER.AVIARY_SSL_CA_DIR = - cumin.conf has: aviary-root-cert: - in addition I propose: aviary-root-cert-dir: Version-Release number of selected component (if applicable): cumin-0.1.5098-2 How reproducible: 100% Steps to Reproduce: 1. Look into condor aviary config 2. Look into cumin config Actual results: option aviary-root-cert-dir not available Expected results: option aviary-root-cert-dir available Additional info:
Hmmm, I'll have to investigate. Off the top of my head, this might require some cert file naming convention (or another config line) to associate certs with particular servers. I don't believe the APIs we're using for ssl that we're using under the hood allow a CA directory to be passed, only a single file (but I could be wrong, maybe they have a mechanism for a dir or multiple files to search). If multiples work, we don't need an association. If not, we do.
Note, There is a simple workaround for this (tested on my VM). Copy a ca-bundle.crt to /etc/cumin/somefile, or even start with a copmpletely blank file, and append all of the server certificates cumin should recognize to this file. Then set aviary-root-cert to point to /etc/cumin/somefile. This will let cumin recognize multiple self-signed server certificates (just like a dir would) without contaminating the /etc/pki/tls/certs/ca-bundle.crt or having an aviary-root-cert-dir option. Essentially, cumin can look at a certificate chain file anywhere, and you can construct your own as you choose.
MRG-Grid is in maintenance and only customer escalations will be considered. This issue can be reopened if a customer escalation associated with it occurs.