juju bootstrap: ERROR [('PEM routines', 'PEM_read_bio', 'no start line')]

[Steve McInerney]

juju is apparently silently reading *.pem files in the CWD and then aborting on them:

Version: 0.5.1+bzr574-0juju2~quantal1

steve@dogmatix:~/juju$ rm *

steve@dogmatix:~/juju$ openssl genrsa -out rabbit-server-privkey.pem 2048
...
steve@dogmatix:~/juju$ openssl req -batch -new -x509 -key rabbit-server-privkey.pem -out rabbit-server-cert.pem -days 10000

steve@dogmatix:~/juju$ juju -l /dev/stderr bootstrap
2012-09-14 15:40:16,104 WARNING S3 API calls not using secure transport
2012-09-14 15:40:16,106 INFO Bootstrapping environment 'canonistack' (origin: distro type: ec2)...
2012-09-14 15:40:17,445 ERROR [('PEM routines', 'PEM_read_bio', 'no start line')]

steve@dogmatix:~/juju$ rm *.pem

steve@dogmatix:~/juju$ juju -l /dev/stderr bootstrap
2012-09-14 15:40:33,087 WARNING S3 API calls not using secure transport
2012-09-14 15:40:33,088 INFO Bootstrapping environment 'canonistack' (origin: distro type: ec2)...
2012-09-14 15:40:43,821 INFO 'bootstrap' command finished successfully

[Clint Byrum (clint-fewbar)]

This is actually txaws doing so, and not juju directly. I'm not sure its a sane behavior for a library, but would like to perhaps have some commentary from txaws developers before patching to outright disabling it. Seems like, if nothing else, the API should allow overriding this behavior, since its possible that txaws code could be run from a hostile CWD.

[Shang Wu (shangwu)]

I encounter this issue after my upgrade to Quantal. Anyway that we can workaround this issue?

[Shang Wu (shangwu)]

My error message is below when I tried to deploy wordpress charm.
http://pastebin.ubuntu.com/1297149/

[Shang Wu (shangwu)]

Issue was resolved by removing the dead link cert-ec2.pem in the /etc/ssl/certs directory. The original file /usr/share/euca2ools/cert-ec2.pem is no longer exist for some reason.

[Rex Tsai (chihchun)]

Please see merge proposal for handling broken PEM files - https://code.launchpad.net/~chihchun/txaws/txaws-lp1050741/+merge/130777

[Shang Wu (shangwu)]

Rex's patch fixes the issue for me.

[Joey Stanford (joey)]

Can we get this patch committed please? I'm also affected.

[Shang Wu (shangwu)]

@Joey, does that patch work for you?

[drewp (drewp)]

I used strace to see what /etc/ssl/certs/*.pem file was the last one to be read and renamed it to not end with .pem. After a few rounds of that, I was able to run juju.

[Joey Stanford (joey)]

@shangwu yes the patch works for me but I agree with Duncan's old comments about logging the error and not just skipping it.