keystone-manage pki_setup does not create pem files

[Mark Miller]

Looks like there’s a bug in pki_setup. It didn’t generate the SSL certs, only the signing certs. Workaround is to make ssl using the signing certs for now.

[ssl]
enable = True
certfile = /etc/keystone/ssl/certs/signing_cert.pem
keyfile = /etc/keystone/ssl/private/signing_key.pem
ca_certs = /etc/keystone/ssl/certs/ca.pem
cert_required = False

Also, if your keystone process is not running as root, make sure the file perms for the pem files are set properly.

Guang

-----------

[ssl]
enable = True
#enable = False
certfile = /etc/keystone/ssl/certs/keystone.pem
keyfile = /etc/keystone/ssl/private/keystonekey.pem
ca_certs = /etc/keystone/ssl/certs/ca.pem
cert_required = False

Mark

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/26436

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/26436
Committed: http://github.com/openstack/keystone/commit/28ef9cdcc6073c2f6600d30b401dcbce81afd4df
Submitter: Jenkins
Branch: master

commit 28ef9cdcc6073c2f6600d30b401dcbce81afd4df
Author: Jamie Lennox <email address hidden>
Date: Thu Apr 4 17:44:01 2013 +1000

    Generate HTTPS certificates with ssl_setup.

    Extracts common OpenSSL functionality from pki_setup and adds a new cli
    command ssl_setup which re-uses this base to generate SSL certificates
    for https.

    Change-Id: Ia34827583bcdfbd871133250681010e642271f07
    Fixes: bug 1155361