precise glance-client doesn't validate ssl certificates correctly

[Brad Marshall]

The version of glance-client in precise doesn't appear to validate SSL certificates correctly.

$ dpkg-query -W glance-client
glance-client 2012.1.3+stable~20120821-120fcf-0ubuntu1
$ glance --version
glance 2012.1.3-dev
$ lsb_release -rd
Description: Ubuntu 12.04.1 LTS
Release: 12.04

By looking at the code it appears that to specify the CA file you need to set an environment variable GLANCE_CLIENT_CA_FILE, or it will default to /etc/ssl/certs/ca-certificates.crt.

The SSL certificate we're trying to use is from GoDaddy, so I have the certficate authority file from them that I'm pointing GLANCE_CLIENT_CA_FILE to.
I've also placed it in /usr/local/share/ca-certificates/gd_bundle.crt and run update-ca-certificates.

$ glance -v -N https://ip.ad.dr.es:5000/v2.0 -I glanceUser -K thisisnotmypassword -T tenant -S keystone --ssl index
Failed to show index. Got error:
Connect error/bad request to Auth service at URL https://ip.ad.dr.es:5000/v2.0/tokens.
Completed in 0.0234 sec.

To ensure that the ca files are correct, I validated that connecting via openssl works fine when specifying the files:

# Without the ca files specified:
$ openssl s_client -connect localhost:5000 2> /dev/null | grep "Verify return code"
    Verify return code: 21 (unable to verify the first certificate)

# Using gd_bundle.crt
$ openssl s_client -CAfile /usr/local/share/ca-certificates/gd_bundle.crt -connect localhost:5000 2>/dev/null | grep "Verify return code"
    Verify return code: 0 (ok)

How do we get the glance command line client to validate correctly with valid SSL certificates?

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[James Page (james-page)]

Hi Brad

If you still have this issue please could you check which version of python-httplib2 you are using. I see some updates related to using system certificates which are probably relevant to this issue.

[James Page (james-page)]

bug 882027 for reference

[Launchpad Janitor (janitor)]

[Expired for glance (Ubuntu) because there has been no activity for 60 days.]