Keystone should not require CA key

[Haneef Ali]

Why do we need CA key? In a real deployment I were to get a cert for my server from Verisign, then verisign won't provide its key.

Basically the code should work without CA key.

I believe it is not required for ssl setup and signing.

[ssl]
#enable = True
#certfile = /etc/keystone/ssl/certs/keystone.pem
#keyfile = /etc/keystone/ssl/private/keystonekey.pem
#ca_certs = /etc/keystone/ssl/certs/ca.pem
#ca_key = /etc/keystone/ssl/private/cakey.pem
#key_size = 1024
#valid_days = 3650
#cert_required = False
#cert_subject = /C=US/ST=Unset/L=Unset/O=Unset/CN=localhost

[signing]
# Deprecated in favor of provider in the [token] section
# Allowed values are PKI or UUID
#token_format =

#certfile = /etc/keystone/ssl/certs/signing_cert.pem
#keyfile = /etc/keystone/ssl/private/signing_key.pem
#ca_certs = /etc/keystone/ssl/certs/ca.pem
#ca_key = /etc/keystone/ssl/private/cakey.pem
#key_size = 2048
#valid_days = 3650
#cert_subject = /C=US/ST=Unset/L=Unset/O=Unset/CN=www.example.com

[Adam Young (ayoung)]

Keystone does not require a CA Key, it generates one only for the "self sign" use case. It does need a signing key and a certificate signed with that key for signing tokens. The text above is not used during normal operations, just during selfsign key generation.

[Haneef Ali (haneef)]

Those should be removed from config file as it is not required. Why do we want to have them in config file?

[Dolph Mathews (dolph)]

Agree, there's no reason why the CA key should be specified in keystone.conf when the path can be specified directly to ssl_setup / pki_setup for bootstrapping a self-signed deployment.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/244414

[Morgan Fainberg (mdrnstm)]

PKI Tokens are Deprecated - this was in support of pki tokens.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Ron De Rose (<email address hidden>) on branch: master
Review: https://review.openstack.org/244414