python-ceilometerclient: Fail to load SSL certificate

[Emilien Macchi]

Icehouse 2014.1.1 on Debian running Ceilometer
Client version: 1.0.9-1

HAproxy does binding between public world and internal network to secure API traffic only between clients & load balancers.
Ceilometer API servers run within internal network using HTTP.
HAproxy does SSL termination for Ceilometer binding to support SSL from public world <-> load-balancers.

When I run CLI, I face this error:
ceilometerclient.exc.CommunicationError: Error communicating with https://my-env:8777 [Errno 185090050] _ssl.c:340: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib

The SSL certificate IS NOT autosigned and is validated by a well-known CA.
All Keystone endpoints are set with HTTPS.
This environment works fine with other OpenStack services (i.e. Nova).

I can use the ceilometer CLI when specifying --insecure.
The .pem file in my HAproxy node contains the CRT, the KEY and the CA.

[Julien Danjou (jdanjou)]

Indeed,it works nice with curl. It's likely that httplib does not load any CA and therefore does not recognize the cert. We should switch to requests to fix that I guess.

[Martin Paulo (martin-paulo)]

I thought I was affected by this (running on OS-X): but yesterday found that upgrading to the latest version of the ceilometer client (1.0.11) removed the need for the -k flag.

[Chris P (plockc)]

try adding something like --os-cacert /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem