SSL verification failures some special deployments

[Ulrich Schwickerath]

Ceilometer currently does not seem to accept or pass the cacert argument to keystone-client. This results in some deployments (like ours) authentications with keystone to fail with SSL errors.

I'd like to propose the attached patch against ceilometer 2013.1.2 to cure this problem.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/38448

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/38448
Committed: http://github.com/openstack/ceilometer/commit/ede3cc0a70d39ec85e511095b82bc2ab54b27bd8
Submitter: Jenkins
Branch: master

commit ede3cc0a70d39ec85e511095b82bc2ab54b27bd8
Author: Julien Danjou <email address hidden>
Date: Wed Jul 24 12:26:15 2013 +0200

    Add support for CA authentication in Keystone

    Change-Id: Ida2240b5217509cbd4116b4d468848760354be18
    Fixes: bug #1194046

[Julian Sternberg (jules-i)]

This fix commit seems to bring another problem.

Let's asume you commet out os_cacert if you dont need ssl,
the SSL auth against keystone will be used anyways as default and fails against it because of no cert and throws this error message:

2013-09-28 01:12:50.328 8621 ERROR keystoneclient.middleware.auth_token [-] HTTP connection exception: [Errno 1] _ssl.c:504: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
2013-09-28 01:12:50.328 8621 WARNING keystoneclient.middleware.auth_token [-] Authorization failed for token <function <lambda> at 0x7fc0bf96fde8>
2013-09-28 01:12:50.328 8621 INFO keystoneclient.middleware.auth_token [-] Invalid user token - rejecting request

[Julien Danjou (jdanjou)]

I suggest you open a new bug report in this case Jules, otherwise we might miss this.

[Julian Sternberg (jules-i)]

Published a new bug report: bug #1232437