SSL custom certificates do not work with anything using request in a venv

[Dmitry Tantsur]

Not a production problem, but hurts development a lot:

$ tox -evenv -- ironic node-list
venv runtests: PYTHONHASHSEED='3657712579'
venv runtests: commands[0] | ironic node-list
The "ironic" CLI is deprecated and will be removed in the S* release. Please use the "openstack baremetal" CLI instead.
Must provide Keystone credentials or user-defined endpoint and token, error was: Could not find versioned identity endpoints when attempting to authenticate. Please check that your auth_url is correct. SSL excep
tion connecting to https://192.168.24.2:13000/: HTTPSConnectionPool(host='192.168.24.2', port=13000): Max retries exceeded with url: / (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_pr
ocess_server_certificate', 'certificate verify failed')],)",),))

This is probably because requests ships its own CA bundle. Setting OS_CACERT to /etc/pki/ca-trust/source/anchors/cm-local-ca.pem or passing it via --os-cacert fixes the problem.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/568853

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/568853
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=28be1058f6518450c1106a4ff0488b2159853680
Submitter: Zuul
Branch: master

commit 28be1058f6518450c1106a4ff0488b2159853680
Author: Dmitry Tantsur <email address hidden>
Date: Wed May 16 15:52:46 2018 +0200

    undercloud: set OS_CACERT when TLS is used

    This fixes TLS errors when anything using python-requests is run
    from a virtualenv.

    Change-Id: Icf659e54e8887dc9759cd4d8f732982ce3e0ae5f
    Closes-Bug: #1771565

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tripleo-heat-templates 9.0.0.0b4 development milestone.