Debian/Ubuntu system wide CA certificate file doesn't seem to be used

[Stuart McLaren]

If you create a CA certificate and add it to the default locations by copying it to /usr/local/share/ca-certificates/ and running 'update-ca-certificates' it should be picked up by anything using openssl.

For example curl:

1) before running update-ca-certificates:

 $ curl https://192.0.2.254:13776
 curl: (60) SSL certificate problem: unable to get local issuer certificate
 More details here: http://curl.haxx.se/docs/sslcerts.html

2) after running update-ca-certificates:

$ curl https://192.0.2.254:13776
{"versions": [{"status": "CURRENT", "updated": "2012-01-04T11:33:21Z", "id": "v1.0", "links": [{"href": "http://192.0.2.254:13776/v1/", "rel": "self"}]}, {"status": "CURRENT", "updated": "2012-11-21T11:33:21Z", "id": "v2.0", "links": [{"href": "http://192.0.2.254:13776/v2/", "rel": "self"}]}]}

although pointing directly to the CA file does work:

 $ cinder --os-cacert /etc/ssl/from-heat-ca.crt list
 +----+--------+--------------+------+-------------+----------+-------------+
 | ID | Status | Display Name | Size | Volume Type | Bootable | Attached to |
 +----+--------+--------------+------+-------------+----------+-------------+
 +----+--------+--------------+------+-------------+----------+-------------+

after update-ca-certificates has been run the CA cert is not picked up automatically from the system-wide location:

 $ cinder list
 ERROR: Unable to establish connection: [Errno 1] _ssl.c:509: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

[Stuart McLaren (stuart-mclaren)]

FWIW this works with the glance client, but not other clients.

[Stuart McLaren (stuart-mclaren)]

some of the clients seem to do a brute force search if nothing is supplied:

def get_system_ca_file():
    """Return path to system default CA file."""
    # Standard CA file locations for Debian/Ubuntu, RedHat/Fedora,
    # Suse, FreeBSD/OpenBSD, MacOSX, and the bundled ca
    ca_path = ['/etc/ssl/certs/ca-certificates.crt',
               '/etc/pki/tls/certs/ca-bundle.crt',
               '/etc/ssl/ca-bundle.pem',
               '/etc/ssl/cert.pem',
               '/System/Library/OpenSSL/certs/cacert.pem',
               requests.certs.where()]
    for ca in ca_path:
        LOG.debug("Looking for ca file %s", ca)
        if os.path.exists(ca):
            LOG.debug("Using ca file %s", ca)
            return ca
    LOG.warn("System ca file could not be found.")

[Stuart McLaren (stuart-mclaren)]

The glance client loads the default OS path using:

self.context.set_default_verify_paths()

I think this is only possible because its not (yet?) using requests.

[Sean McGinnis (sean-mcginnis)]

Closing stale bug. If this is still an issue please reopen.