Barbican certificate import issue

[Satish Patel]

I have deployed latest skyline with Zed openstack release. I am playing with octavia and Barbican secret store. When I am trying to import my SSL certificate I am getting strange private key validation issue. Same key works when I use command line to import certificate in barbican.

Please enter a correct private key, format is refer to the left tip!

I have tried multiple keys but everyone throwing same errors but nothing works here.

[Satish Patel (satish-txt)]

Find attached screenshot

[Satish Patel (satish-txt)]

Any update?

[xusongfu (xusongfu)]

Hi,

I cannot determine the cause of this problem, because the image you provided cannot see the complete characters.

The images of correctly formatted characters can be referenced in the attachment.

If you have any other questions, welcome your feedback.

Thank you.

[Satish Patel (satish-txt)]

Give me few minutes and I will upload new screenshot. Still I am uploading my cert and key file here so its not something copy paste issue.

Why skyline saying or throwing error that its invalidate?

[conna (yangshaoxue)]

The certificate requires RSA encryption.

Skyline verifies '-----BEGIN RSA PRIVATE KEY-----' and '-----END RSA PRIVATE KEY-----'.

[Satish Patel (satish-txt)]

Oh wait, so "RSA" keyword has to be there?

Damn when I generate certificate on my compute it just generated crt and key file without RSA keyword. So I was just uploading that as it as.

Why do we have hard requirement to have "RSA" keyword in key?

[conna (yangshaoxue)]

Barbican in Skyline is only used to store certificates for Octavia.

For safety and effectiveness, we strictly restrict certificates to RSA format.

In the future, Skyline will consider relaxing the restrictions to support more certificate formats.

[Satish Patel (satish-txt)]

Shouldn’t be put warning or error related RSA instead just saying invalid? I burn my brain behind this and found it required RSA. What if I just change keyword to RSA and keep cipher different? How does it validate that it’s true RSA?

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/skyline-console 3.0.0.0rc2 release candidate.

[Satish Patel (satish-txt)]

Just curious that what is the fix here? I didn’t see patch anywhere.

[xusongfu (xusongfu)]

Here is the patch: https://review.opendev.org/c/openstack/skyline-console/+/896615

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/skyline-console 4.0.0.0rc1 release candidate.