Don't add CA certs to RabbitMQ config unless they exist

[Major Hayden]

CA certificates aren't generated for RabbitMQ when the self-signed certificate option is used. This causes SSL connections to RabbitMQ to fail.

We should probably only set the CA certificate path in the RabbitMQ configuration file if the user has explicitly provided one.

The error looks like:

=ERROR REPORT==== 18-Oct-2015::18:48:37 ===
Error on AMQP connection <0.1884.0>:
{ssl_upgrade_error,
    {options,{cacertfile,"/etc/rabbitmq/rabbitmq-ca.pem",{error,enoent}}}}

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/236731

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/236731
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible/commit/?id=d7031f954de7d73a96c303aed8b6e1f4441c03b0
Submitter: Jenkins
Branch: master

commit d7031f954de7d73a96c303aed8b6e1f4441c03b0
Author: Major Hayden <email address hidden>
Date: Sun Oct 18 14:00:31 2015 -0500

    Additional RabbitMQ SSL fixes

    This patch fixes two problems with RabbitMQ's SSL/TLS listener.

    * When self-signed certificates are used, the CA cert isn't created, but it's
      included with the RabbitMQ server config anyway (bug 1507364).

    * Self-signed certificates are owned by root within RabbitMQ's configuration
      directory and are unreadable by RabbitMQ. User-provided certificates aren't
      affected (bug 1506992).

    Closes-bug: 1506992
    Closes-bug: 1507364

    Change-Id: If4f6a325eea4772f2fad4604785241b67adfaaf6

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/237431
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible/commit/?id=79a159df84710427083a81c2c66c475c3673db0c
Submitter: Jenkins
Branch: kilo

commit 79a159df84710427083a81c2c66c475c3673db0c
Author: Major Hayden <email address hidden>
Date: Sun Oct 18 14:00:31 2015 -0500

    Additional RabbitMQ SSL fixes

    This patch fixes two problems with RabbitMQ's SSL/TLS listener.

    * When self-signed certificates are used, the CA cert isn't created, but it's
      included with the RabbitMQ server config anyway (bug 1507364).

    * Self-signed certificates are owned by root within RabbitMQ's configuration
      directory and are unreadable by RabbitMQ. User-provided certificates aren't
      affected (bug 1506992).

    Closes-bug: 1506992
    Closes-bug: 1507364

    Change-Id: If4f6a325eea4772f2fad4604785241b67adfaaf6
    (cherry picked from commit d7031f954de7d73a96c303aed8b6e1f4441c03b0)

[Davanum Srinivas (DIMS) (dims-v)]

This issue was fixed in the openstack/openstack-ansible 11.2.14 release.

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/openstack-ansible 11.2.15 release.