Unhelpful error message when keystone uses self-signed SSL certificates

[Udi Kalifon]

When keystone is configured to use SSL and its certificates are not signed by a trusted authority, all the keystone client commands return:

Authorization Failed: SSL exception connecting to https://127.0.0.1:35357/v2.0/tokens

It would be better to instruct the user to pass the "--insecure" command-line option to the keystone command.

I set up my keystone with SSL like this:
1) Uncomment the following lines in keystone.conf:
[ssl]
enable = True
certfile = /etc/keystone/pki/certs/ssl_cert.pem
keyfile = /etc/keystone/pki/private/ssl_key.pem
ca_certs = /etc/keystone/pki/certs/cacert.pem
ca_key = /etc/keystone/pki/private/cakey.pem

2) Run 'keystone-manage ssl_setup --keystone-user keystone --keystone-group keystone' and restart the service

3) Change the endpoints in the SQL table to point to https://...

To get the error, source the following file (change the username and password, and make sure the endpoint correctly points to https://...):
export OS_USERNAME=admin
export OS_TENANT_NAME=admin
export OS_PASSWORD=18ee8218fe2d4e6e
export OS_AUTH_URL=https://127.0.0.1:35357/v2.0/

Now run: keystone user-list
You get: Authorization Failed: SSL exception connecting to https://127.0.0.1:35357/v2.0/tokens
You are supposed to run: keystone --insecure user-list

It's really hard to tell by this error message what the cause of the problems is. In addition to that, there is nothing in the keystone logs. Please provide a more informative error message, and possibly some logs to indicate what went wrong.

Thanks :)

[Dolph Mathews (dolph)]

There wouldn't be any impact on keystone itself (nor anything for it to log), but we might be able to get some better feedback out of requests, which is what is producing the SSL validation failure.

[Rob Crittenden (rcritten)]

IMHO the problem is that the keystone session is eating the SSL error and reporting this generic message. It would be straightforward enough in keystoneclient/session.py where it catches requests.exceptions.SSLError to simply include that in the value of msg.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/129769

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/129769
Committed: https://git.openstack.org/cgit/openstack/python-keystoneclient/commit/?id=cccc065516ab683b5c1aaf82a51eeec744c34eae
Submitter: Jenkins
Branch: master

commit cccc065516ab683b5c1aaf82a51eeec744c34eae
Author: Rodrigo Duarte Sousa <email address hidden>
Date: Mon Oct 20 22:46:33 2014 -0300

    Improve feedback message in SSL error

    Adds the error message to give a hint to the user about
    what happened.

    Change-Id: I9ca56de8592e65194062038c81b468be72ffb2d9
    Closes-Bug: 1297280