nova list failure when quantum_url points to HTTPS endpoint

[John Dewey]

We are using the standard UEC grizzly packages with Ubuntu 12.04, and using keystone v3, nova v2, and quantom v2 APIs.
All of our endpoints have HTTPS urls, which are offloaded to a load balancer with standard Verisign certs.

We are able to query quantum via the CLI, however, when we attempt a `nova list`, we end up with the following error.

http://paste.openstack.org/show/42553/

When changing nova.conf's quantum_url from an offloaded HTTPs url to a standard HTTP url, all works as expected.

Again, we are not using self signed certs, and all works as expected when using the quauntum client CLI, but nova.conf's quantum_url does not work
when pointed to HTTPS.

ii python-quantumclient 1:2.2.0-0ubuntu1~cloud0 client - Quantum is a virtual network service for Openstack
ii python-keystoneclient 1:0.2.3-0ubuntu2.2~cloud0 Client library for OpenStack Identity API
ii python-novaclient 1:2.13.0-0ubuntu1~cloud0 client library for OpenStack Compute API

[John Dewey (retr0h)]

More information in this gist:

https://gist.github.com/alanmeadows/cfabd1117eb12e5976f1/raw/32a11b7562bd81cd77b3a025c95868b32a998761/gistfile1.txt

[Yaguang Tang (heut2008)]

it's a pity that neutron (quantum ) client doesn't support TLS currently.

[Jay Pipes (jaypipes)]

This is a serious issue. Hoping we can get some eyes on this...

[Yaguang Tang (heut2008)]

python-neutronclient now supports ssl , I think we just need a small fix on nova side to support https.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/39651

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/39651
Committed: http://github.com/openstack/nova/commit/cdfd5fb27d3d35e52c56d83290fc5d2c07c48865
Submitter: Jenkins
Branch: master

commit cdfd5fb27d3d35e52c56d83290fc5d2c07c48865
Author: Yaguang Tang <email address hidden>
Date: Thu Aug 1 16:10:40 2013 +0800

    Add support for Neutron https endpoint

    This patch adds a parameter to specify Neutronclient ca certificate file
    location to support Neutron https endpoint.

    Fix bug #1206330

    Change-Id: I9ecdd24cf0efcb5ef895e529e516d248214592c1

[Matt Riedemann (mriedem)]

I'm not sure why launchpad didn't mark this as in progress when the patch was submitted or fix committed when the patch was merged. I've been seeing some flakiness in launchpad tracking status lately.