What is the correct behavior of OS_CACERT in python clients?
I've a doubt is this could be bug, but after comparing nova and glance clients, I see some inconsistencies.
If I have unset the OS_CACERT variable and I run the follows
(.venv)vjmorale@gmw-vjmorale:~/openstack-src$ nova image-list
ERROR: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
(.venv)vjmorale@gmw-vjmorale:~/openstack-src$ nova --insecure image-list
+--------------------------------------+--------------------------+--------+--------+
| ID | Name | Status | Server |
+--------------------------------------+--------------------------+--------+--------+
...
(.venv)vjmorale@gmw-vjmorale:~/openstack-src$ nova image-list
ERROR: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
(.venv)vjmorale@gmw-vjmorale:~/openstack-src$ nova --insecure image-list
+--------------------------------------+--------------------------+--------+--------+
| ID | Name | Status | Server |
+--------------------------------------+--------------------------+--------+--------+
...
At this point everything seems right, but once that I set OS_CACERT variable, its behavior changes
(.venv)vjmorale@gmw-vjmorale:~/openstack-src$ nova image-list
+--------------------------------------+--------------------------+--------+--------+
| ID | Name | Status | Server |
+--------------------------------------+--------------------------+--------+--------+
...
(.venv)vjmorale@gmw-vjmorale:~/openstack-src$ nova --insecure image-list
+--------------------------------------+--------------------------+--------+--------+
| ID | Name | Status | Server |
+--------------------------------------+--------------------------+--------+--------+
...
(.venv)vjmorale@gmw-vjmorale:~/openstack-src$ glance image-list
Host "xxx.xxx.xxx" does not match x509 certificate contents: CommonName "xxx.xxx.xxx", subjectAltName "DNS:xxx.xxx.xxx, IP Address:127.0.0.1"
(.venv)vjmorale@gmw-vjmorale:~/openstack-src$ glance --insecure image-list
+--------------------------------------+--------------------------+-------------+------------------+--------------+--------+
| ID | Name | Disk Format | Container Format | Size | Status |
+--------------------------------------+--------------------------+-------------+------------------+--------------+--------+
...
Is there a problem with my certificate? or there is a bug in one of the clients?
add a comment