keystone-all crashes when ca_certs is not defined in conf

[kio]

When [ssl] ca_certs parameter is commented on keystone.conf, ssl module try to load the default ca_cert file (/etc/keystone/ssl/certs/ca.pem) and raises an IOError exception because it didn't find the file.

This happens running on Python 2.7.9.

I have a keystone cluster running on Python 2.7.7, with the very same keystone.conf file, and that crash doesn't happen.

If any further information is required, don't hesitate in contacting me.

[Morgan Fainberg (mdrnstm)]

Which version of Keystone (OpenStack) are you seeing this with? (e.g. Icehouse, Juno, Kilo, Master)? And how was Keystone installed? (e.g. via pip, from an apt repository, RDO, etc)

Which distribution are you using? (Ubuntu, Fedora, RHEL, etc) And which release?

Are there other settings in the

[Morgan Fainberg (mdrnstm)]

Please mark this bug as "new" when you respond with the answers to my above questions.

thanks!

[kio (caiobrentano)]

Sorry for the missing information. I'm not used to report bugs! :)

The Keystone version is Github 2014.1 release. It was cloned from github and installed via pip from an internal repository.

The OS distribution is Red Hat Enterprise Linux Server release 6.5 (Santiago)

[Morgan Fainberg (mdrnstm)]

Don't worry about the incomplete bug report, it's why I asked the questions :). This gives me enough information to start looking at it now and/or how to duplicate it. There are many variations and sometimes duplication is hard with so many variations.

Thanks!

[Dolph Mathews (dolph)]

If this can be reproduced against 2014.1 icehouse, I would consider it to be a critical issue for our core use case (default SSL configuration w/ apache httpd).

[Morgan Fainberg (mdrnstm)]

I have been unable to duplicate this bug. Is it possible to get more information on how to duplicate this?

Please set this bug back to "New" once you've answered the question(s)

[Brant Knudson (blk-u)]

icehouse is now eol, so I don't see any need to spend more time on this.

[David Stanek (dstanek)]

I just quickly tried to reproduce and failed. Is there any reason not to mark this as invalid?

[Launchpad Janitor (janitor)]

[Expired for Keystone because there has been no activity for 60 days.]