lxd cluster invalid certificate when using interactive credentials

[John A Meinel]

If you try to set up a remote LXD cloud with mode 'interactive' you end up getting:
$ juju add-model nuc1 lxd-nuc1
ERROR failed to open environ: Get https://192.168.86.100:8443/1.0: x509: certificate is valid for 127.0.0.1, ::1, not 192.168.86.100

According to this bug:
https://github.com/lxc/lxd/issues/6802

LXD intentionally does *not* regenerate its certificate when you add a non-local IP address (so that existing clients can trust the same certificate.)

That means that when talking to LXD, we need to verify the fingerprint, rather than assuming it has a signed certificate for the IP address that we are connecting to. I would have thought that we were using the LXD library, which should already be handling this. But maybe we are doing something like a URL test using the stock HTTP library, which would complain about an invalid TLS certificate.

[John A Meinel (jameinel)]

Note that if I set up the remote LXD using auth-type: certificate instead of 'interactive' it works just fine. It is *way* more difficult to set up, as I have to generate a certificate, trust it in the remote, etc.

I was able to get it to spawn a container after using Certificate authentication.

[Achilleas Anagnostopoulos (achilleasa)]

I have been so far unable to replicate this so I can verify whether a potential fix proposal actually works.

Here is what I have tried so far:

```
# Print cert for lxd running in vagrant box (I ran lxd init when the machine IP was 192.168.13.90; I then changed the public IP for the box to 192.168.13.99 and I am using that when adding the cloud)
$ openssl s_client -connect 192.168.13.99:8443 < /dev/null | openssl x509 -noout -text | grep -C3 -i dns
Can't use SSL_get_servername
depth=0 O = linuxcontainers.org, CN = root@ubuntu-bionic
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 O = linuxcontainers.org, CN = root@ubuntu-bionic
verify error:num=21:unable to verify the first certificate
verify return:1
DONE
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Alternative Name:
                DNS:ubuntu-bionic, IP Address:10.0.2.15, IP Address:192.168.13.90 <---- original public IP was this one
    Signature Algorithm: sha256WithRSAEncryption
         79:05:d6:a3:11:85:93:cf:f0:e9:91:0c:26:d4:72:d4:bf:db:
         72:fd:99:b6:1f:7b:ad:14:a3:d7:a7:cf:ee:63:5f:9d:1d:04:

# Add cloud to k8s controller
$ juju bootstrap microk8s microk8s-1
$ juju add-cloud -c microk8s-1 --force
Cloud Types
  lxd
  maas
  manual
  openstack
  vsphere

Select cloud type: lxd

Enter a name for your lxd cloud: remote1

Enter the API endpoint url for the remote LXD server: https://192.168.13.99:8443

Auth Types
  certificate

Enter region [default]:

Enter the API endpoint url for the region [use cloud api url]:

Enter another region? (y/N):

Cloud "" added to controller "microk8s-1".
WARNING loading credentials: credentials for cloud remote1 not found
To upload a credential to the controller for cloud "remote1", use
* 'add-model' with --credential option or
* 'add-credential -c remote1'.

# Now add credentials (The !!! errors are logging lines that I injected to check the host used to verify the cert)
juju add-credential remote1
This operation can be applied to both a copy on this client and to the one on a controller.
Do you want to add a credential to:
    1. client only (--client)
    2. controller "microk8s-1" only (--controller microk8s-1)
    3. both (--client --controller microk8s-1)
Enter your choice, or type Q|q to quit: 3
Using cloud "remote1" from the controller to verify credentials.
Enter credential name: remote1

Regions
  default

Select region [any region, credential is not region specific]:

Auth Types
  certificate
  interactive

Select auth type [interactive]: interactive

Enter trust-password:***

Loaded client cert/key from "/home/achilleas/.local/share/juju/lxd"
Reusing certificate from LXD server.
Credential "remote1" added locally for cloud "remote1".

Controller credential "remote1" for user "admin" for cloud "remote1" on controller "microk8s-1" added.
For more information, see ‘juju show-credential remote1 remote1’.

# Add model
juju add-model foo remote1 --debug
16:18:44 INFO juju.cmd supercommand.go:83 running juju [2.7.7 4d088f358a987cfc41546540247155662c68daf9 gc go1.14.1]
16:18:44 DEBUG juju.cmd supercommand.go:84 args: []string{"juju", "add-model", "f...

[Shawn Weeks (absolutesantaja)]

I'm seeing this on lxd without Juju as well. New install of 20.04 and LXD from snap version 4.1. Nowhere during my LXD setup did I specify 127.0.0.1

[Canonical Juju QA Bot (juju-qa-bot)]

This Medium-priority bug has not been updated in 60 days, so we're marking it Low importance. If you believe this is incorrect, please update the importance.