The default PackStack configuration of Keystone generates UUID tokens. Administrators wishing to generate and use PKI tokens must: 1) Generate the PKI files using the keystone-manage command: # keystone-manage pki_setup \ --keystone-user keystone \ --keystone-group keystone 2) Ensure that Keystone has ownership of the files in the /etc/keystone/ssl/ and /var/log/keystone/ directories: # chown -R keystone:keystone /etc/keystone/ssl/ /var/log/keystone/ 3) Update the value of the token_format configuration key in /etc/keystone/keystone.conf to PKI: # openstack-config --set /etc/keystone/keystone.conf \ token_format PKI 4) Restart the openstack-keystone service: # service openstack-keystone restart