The --insecure flag causes requests to switch to port 80

Bug #1714086 reported by Cory Wright
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
python-openstackclient
Incomplete
Undecided
Unassigned

Bug Description

I'm setting up an internal keystone server that is served through haproxy on port 443 with a (temporary) self signed certificate. To test my installation I need to be able to disable certificate verification during calls to keystone.

    $ echo $OS_AUTH_URL
    https://10.10.11.12:443/v3

When I try to connect I get an error due to failing to verify the certificate:

    $ openstack catalog show object-store
    Discovering versions from the identity service failed when creating the password plugin. Attempting to determine version from URL.
    SSL exception connecting to https://10.10.11.12:443/v3/auth/tokens: ("bad handshake: Error([('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')],)",)

The output of `openstack --help` shows that the `--insecure` flag can be used to disable certificate verification:

    $ openstack --help|grep '^ --insecure'
      --insecure Disable server certificate verification

However, when I pass this flag to the `openstack` command it seems that, instead of disabling certificate verification, the `OS_AUTH_URL` setting is modified to change the scheme to http and port to 80:

    $ openstack --insecure catalog show object-store
    Unable to establish connection to http://10.10.11.12/v3/auth/tokens: HTTPConnectionPool(host='10.10.11.12', port=80): Max retries exceeded with url: /v3/auth/tokens (Caused by NewConnectionError('<requests.packages.urllib3.connection.HTTPConnection object at 0x7f220ff20490>: Failed to establish a new connection: [Errno 111] Connection refused',))

Either the documentation for the `--insecure` flag is wrong, or the flag is not implemented as documented.

Revision history for this message
Dr. Jens Harbott (j-harbott) wrote :

I cannot reproduce this with the current client version. Please show the output of "openstack --version" and "openstack --debug --insecure catalog show object-store".

Changed in python-openstackclient:
status: New → Incomplete
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.