unable to load certificate should abort request

[Dolph Mathews]

From the mailing list, the following message should be improve with decent help, e.g.:

  Unable to load certificate; ensure you've configured PKI with `keystone-manage pki_setup`

Instead of simply:

(sqlalchemy.engine.base.Engine): 2013-01-23 17:04:57,904 INFO ('106298a47e5a4d129c7b8571e188c51e', 1)
(keystone.common.cms): 2013-01-23 17:04:57,990 ERROR Signing error: Error opening signer certificate /etc/keystone/ssl/certs/signing_cert.pem
140702974211744:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('/etc/keystone/ssl/certs/signing_cert.pem','r')
140702974211744:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
unable to load certificate

Then the following code should never be reached:

(root): 2013-01-23 17:04:57,991 ERROR Command 'openssl' returned non-zero exit status 3
Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/keystone-2013.1-py2.7.egg/keystone/common/wsgi.py", line 215, in __call__
    result = method(context, **params)
  File "/usr/local/lib/python2.7/dist-packages/keystone-2013.1-py2.7.egg/keystone/token/controllers.py", line 118, in authenticate
    config.CONF.signing.keyfile)
  File "/usr/local/lib/python2.7/dist-packages/keystone-2013.1-py2.7.egg/keystone/common/cms.py", line 140, in cms_sign_token
    output = cms_sign_text(text, signing_cert_file_name, signing_key_file_name)
  File "/usr/local/lib/python2.7/dist-packages/keystone-2013.1-py2.7.egg/keystone/common/cms.py", line 135, in cms_sign_text
    raise subprocess.CalledProcessError(retcode, "openssl")
CalledProcessError: Command 'openssl' returned non-zero exit status 3

[Brad Topol (btopol)]

Dolph, is it possible for me to reproduce this bug on devstac? If you can show me how I could reproduce it I am willing to look at fixing it

[Dolph Mathews (dolph)]

I assume you'd just have to undo the work done by pki_setup (which devstack already called for you), which is basically to empty /etc/keystone/ssl/ , or whatever directory is specified by keystone.conf [signing] ca_certs. It creates 4 files, AFAIK.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/22716

[David Höppner (0xffea)]

Output looks so now:

DEBUG [passlib.registry] registered 'sha512_crypt' handler: <class 'passlib.handlers.sha2_crypt.sha512_crypt'>
ERROR [keystone.common.cms] Signing error: Unable to load certificate - ensure you've configured PKI with 'keystone-manage pki_setup'
WARNING [keystone.common.wsgi] Unable to sign token.
DEBUG [keystone.common.wsgi] ******************** RESPONSE HEADERS ********************

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/22716
Committed: http://github.com/openstack/keystone/commit/b1474da1413b0334b8975875ebb584df8a1342f5
Submitter: Jenkins
Branch: master

commit b1474da1413b0334b8975875ebb584df8a1342f5
Author: David Höppner <email address hidden>
Date: Fri Feb 22 18:43:56 2013 +0100

    unable to load certificate should abort request

    If openssl returns with a command line error (3), we assume
    the PKI certificate is not properly installed. Added
    'try ... except' blocks to cms_sign_text and cms_sign_token
    calls.

    Fixes: bug #1103569
    Change-Id: Iad98738e990d3ab1ec0d0015840d76cf948ae560