Please allow uploading private trusted CA certificates when using TLS/SSL

[ggolin]

In Mirantis-7 using a certificate signed by an internal authority (unknown to fuel) causes the deployment to fail because of SSL verification errors. Please add a capability to import custom authority certificates when using TLS/SSL.

[Dmitry Klenov (dklenov)]

ggolin: can you please provide detailed steps you follow to reproduce the error?

[ggolin (greg-golin)]

Here you go, dklenov:

1. Create an environment in fuel web UI
2. In the Settings page enable Public TLS for both Horizon and Public end points
3. Use your own certificate and key signed by an internal authority. This is important because if you use a known CA the failure should not occur.
4. Start the deployment

Deployment will fail with keystone error regarding not being able to verify the certificate authority with which you signed your certificate.

I should note that this problem can be solved by writing a very simple plugin that installs your CA certificates on the target nodes in the pre_deployment stage. This is what I am using in the interim.

[Stanislaw Bogatkin (sbogatkin)]

There is not enough info. In our tests we use self-signed certs - fuel don't know anything about them. Process of adding certificates to trust chain is the same for generated and user certs. Could you please, give some more information about your keys, certs and error you met?

[ggolin (greg-golin)]

I am sorry, how does a bug go from an incomplete to a confirmed status and then development states there is not enough information?

[Stanislaw Bogatkin (sbogatkin)]

Sorry for a long answer, Greg. Seems I got your question. You can add provide full chain of certificates to Fuel UI and then it will work right, because all this chain will be added to trusted for all nodes in whole environment. All you need to do is put
-----BEGIN YOUR CERTIFICATE-----
-----END YOUR CERTIFICATE-----
-----BEGIN INTERMEDIATE CERTIFICATE-----
-----END INTERMEDIATE CERTIFICATE-----
-----BEGIN INTERMEDIATE CERTIFICATE-----
-----END INTERMEDIATE CERTIFICATE-----
-----BEGIN ROOT CERTIFICATE-----
-----END ROOT CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----

instead of just putting
-----BEGIN YOUR CERTIFICATE-----
-----END YOUR CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----

in to the certificate field for OpenStack public endpoints

[ggolin (greg-golin)]

Very well, thank you. This needs to be added to the documentation, or the
UI should say something like "Upload certificate *chain*" because otherwise
this is not apparent.

On Thu, Nov 12, 2015 at 3:39 AM, Stanislaw Bogatkin <email address hidden>
wrote:

> Sorry for a long answer, Greg. Seems I got your question. You can add
> provide full chain of certificates to Fuel UI and then it will work right,
> because all this chain will be added to trusted for all nodes in whole
> environment. All you need to do is put
> -----BEGIN YOUR CERTIFICATE-----
> -----END YOUR CERTIFICATE-----
> -----BEGIN INTERMEDIATE CERTIFICATE-----
> -----END INTERMEDIATE CERTIFICATE-----
> -----BEGIN INTERMEDIATE CERTIFICATE-----
> -----END INTERMEDIATE CERTIFICATE-----
> -----BEGIN ROOT CERTIFICATE-----
> -----END ROOT CERTIFICATE-----
> -----BEGIN RSA PRIVATE KEY-----
> -----END RSA PRIVATE KEY-----
>
> instead of just putting
> -----BEGIN YOUR CERTIFICATE-----
> -----END YOUR CERTIFICATE-----
> -----BEGIN RSA PRIVATE KEY-----
> -----END RSA PRIVATE KEY-----
>
> in to the certificate field for OpenStack public endpoints
>
> ** Changed in: fuel
> Status: Confirmed => Invalid
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1503023
>
> Title:
> Please allow uploading private trusted CA certificates when using
> TLS/SSL
>
> Status in Fuel for OpenStack:
> Invalid
>
> Bug description:
> In Mirantis-7 using a certificate signed by an internal authority
> (unknown to fuel) causes the deployment to fail because of SSL
> verification errors. Please add a capability to import custom
> authority certificates when using TLS/SSL.
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/fuel/+bug/1503023/+subscriptions
>

--
    "The secret of getting ahead is getting started. The secret of getting
started is breaking your complex overwhelming tasks into small manageable
tasks, and then starting on the first one."

    - Mark Twain, humorist and author (1835 - 1910)