Default to requests cert bundle instead of nothing

Bug #1362179 reported by Rob Crittenden
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Glance Client
Fix Released
Undecided
Unassigned

Bug Description

If no CA certificate was provided to a glance client call then verify is set to None which generally results in failure because there are no CA certs at all to validate against. It should instead default to requests.certs.where() to use the per-platform system bundle.

From certs.py:

"This module returns the preferred default CA certificate bundle.

If you are packaging Requests, e.g., for a Linux distribution or a managed
environment, you can change the definition of where() to return a separately
packaged CA bundle."

In Fedora/RHEL this is set to /etc/pki/tls/certs/ca-bundle.crt

In Ubuntu 14.04 and Debian Wheezy it is set to /etc/ssl/certs/ca-certificates.crt

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to python-glanceclient (master)

Reviewed: https://review.openstack.org/117247
Committed: https://git.openstack.org/cgit/openstack/python-glanceclient/commit/?id=929a72e76fe1dd72e8fa28a8e3e1b574a6c19973
Submitter: Jenkins
Branch: master

commit 929a72e76fe1dd72e8fa28a8e3e1b574a6c19973
Author: Rob Crittenden <email address hidden>
Date: Tue Aug 26 18:12:19 2014 -0400

    Default to system CA bundle if no CA certificate is provided

    If no CA certificate is provided to be used for validation then
    fall back to the system-wide CA bundle as presented by
    python-requests.

    Change-Id: I05206a868150d4b62b6f1b833310eb9b86b7c4f8
    Closes-bug: #1362179

Changed in python-glanceclient:
status: New → Fix Committed
Louis Taylor (kragniz)
Changed in python-glanceclient:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.