Keystone Essex does not support TLS over HTTPS

[Chris Hoge]

The most recent stable release of Keystone does not support TLS security over HTTPS. This functionality was available in the Diablo release, but was removed in Essex.

TLS should be enabled by default. Credentials should never be sent to an authentication server as plain text. If OpenStack APIs are made publicly available, the Keystone server must also be on a public interface to be accessible to the Nova, Glance, and Swift client tools. This is a major security vulnerability that impacts all production deployments.

[Adam Young (ayoung)]

Steps to run Keystone over HTTPS by running it in Apache HTTPD are posted here:

http://adam.younglogic.com/2012/04/keystone-httpd/

It is possible to set up Apache HTTPD such that admin listens on port 35757 and main is on 5000 by specifying additional virtual host directives for each port.

[Thierry Carrez (ttx)]

And it's also possible to run keystone behind an SSL proxy.

[Robert Clark (robert-clark)]

There's a whole bunch of stuff in OpenStack that currently doesn't implement SSL correctly or incurs significant cost when in use. Generally speaking, we (HP) have had a lot of success using Pound for SSL termination in front of services where we have a clear Confidentiality or Integrity requirement.

That said, I agree that Keystone should be secure by default, with the option for this to be disabled or changed by whoever administers the deployment.

[Alan Pevec (apevec)]

This is fixed on master https://github.com/openstack/keystone/commit/8de61f8af43563b1d93291c868634810d9e42902
but as a new feature isn't appropriate for stable/essex (see http://wiki.openstack.org/StableBranch#Appropriate_Fixes )
Alternative for stable/essex deployments is to use SSL termination in front of services as suggested in previous comments.