<div dir="ltr"><br><br><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Nov 9, 2017 at 3:27 PM, David Gabriel <span dir="ltr"><<a href="mailto:davidgab283@gmail.com" target="_blank">davidgab283@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">My objective is to create a stack using Heat.<div>Initially, my code worked properly with http access but when our Openstack is updated the access is becoming via https so I got the errors I sent in the previous email.</div><div>So I think I need to <b>authenticate </b>using the .pem certificate.</div><div>But, I don't know where exactely (which location) I put the .pem file in order to be visible to the heatclient (or keystone) and how shall I update my code ?</div></div></blockquote><div><br></div><div>I really suggest you ask your administrator what you should be doing. Having TLS on the endpoint doesn't necessarily mean that you need to authenticate. It could mean that all you need to do is trust the CA that issued the certificate that Heat (or the load balancer) is serving publicly.</div><div><br></div><div> <br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><br></div><div>I am confusing a little bit!</div><div>Thanks in advance.</div><div>Best regards.</div></div><div class="gmail_extra"><br><div class="gmail_quote">2017-11-09 9:05 GMT+01:00 Juan Antonio Osorio <span dir="ltr"><<a href="mailto:jaosorior@gmail.com" target="_blank">jaosorior@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Alright,<br><br></div>So, first question. What do you actually want to do? Do you need to authenticate with the heat endpoint with TLS (using client certificates) ? Or, do you want to merely use TLS to communicate with Heat and you're getting this verification issue?<br></div><div class="m_4121009849930676061HOEnZb"><div class="m_4121009849930676061h5"><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Nov 8, 2017 at 10:48 PM, David Gabriel <span dir="ltr"><<a href="mailto:davidgab283@gmail.com" target="_blank">davidgab283@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I forget to send the errors I got:<div><br></div><div><div> File "/usr/lib/python2.7/dist-packa<wbr>ges/heatclient/v1/stacks.py", line 109, in create</div><div> data=kwargs, headers=headers)</div><div> File "/usr/lib/python2.7/dist-packa<wbr>ges/heatclient/common/http.py"<wbr>, line 223, in json_request</div><div> resp = self._http_request(url, method, **kwargs)</div><div> File "/usr/lib/python2.7/dist-packa<wbr>ges/heatclient/common/http.py"<wbr>, line 166, in _http_request</div><div> **kwargs)</div><div> File "/usr/local/lib/python2.7/dist<wbr>-packages/requests/api.py", line 53, in request</div><div> return session.request(method=method, url=url, **kwargs)</div><div> File "/usr/local/lib/python2.7/dist<wbr>-packages/requests/sessions.py<wbr>", line 468, in request</div><div> resp = self.send(prep, **send_kwargs)</div><div> File "/usr/local/lib/python2.7/dist<wbr>-packages/requests/sessions.py<wbr>", line 576, in send</div><div> r = adapter.send(request, **kwargs)</div><div> File "/usr/local/lib/python2.7/dist<wbr>-packages/requests/adapters.py<wbr>", line 447, in send</div><div> raise SSLError(e, request=request)</div><div>SSLError: [Errno 1] _ssl.c:510: error:14090086:SSL routines:SSL3_GET_SERVER_CERTI<wbr>FICATE:certificate verify failed</div><div>127.0.0.1 - - [08/Nov/2017 20:34:56] "POST /stack_create HTTP/1.1" 500 2801</div></div><div><br></div></div><div class="m_4121009849930676061m_2982919140730080456HOEnZb"><div class="m_4121009849930676061m_2982919140730080456h5"><div class="gmail_extra"><br><div class="gmail_quote">2017-11-08 21:43 GMT+01:00 David Gabriel <span dir="ltr"><<a href="mailto:davidgab283@gmail.com" target="_blank">davidgab283@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Dear Juan,<div><br></div><div>Thanks so much for your reply.</div><div>I fact, the command you suggest leads to the structure of a .pem file like it is shown in the reference you provide.</div><div><br></div><div>Let me please ask another question related to the new pem file.</div><div>In fact, I want to use use it in to call python-heatclient API in order to create stacks (Openstack address is based on https).</div><div>I am wondering, where to copy this pem file and how to refer it ?</div><span><div><br></div><div>Thanks in advance.</div><div>Best regards.</div><div><br></div><div><br></div></span></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="m_4121009849930676061m_2982919140730080456m_8345829170647907143h5">2017-11-08 15:39 GMT+01:00 Juan Antonio Osorio <span dir="ltr"><<a href="mailto:jaosorior@gmail.com" target="_blank">jaosorior@gmail.com</a>></span>:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="m_4121009849930676061m_2982919140730080456m_8345829170647907143h5"><div dir="ltr"><div><div>Hello,<br><br>You need to verify the files and check how they look like. A good guide to do this is this one <a href="http://how2ssl.com/articles/working_with_pem_files/" target="_blank">http://how2ssl.com/articles/wo<wbr>rking_with_pem_files/</a> .<br>.cert
and .key are not actual formats, but might actually contain the cert
and the key in PEM format. The main giveaway is that they should contain
the header. If you will use the file for HAProxy, then you need the
certificate and key in the same file. So you would do something like
this:<br><br></div> $ cat mycertificate.cert mykey.key > cert-and-key.pem<br><br></div>And
the resulting file is something you could use for your HAProxy
instance. But again, it all depends on what you will use it for.</div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="m_4121009849930676061m_2982919140730080456m_8345829170647907143m_-7208530353036770600h5">On Wed, Nov 8, 2017 at 3:36 PM, David Gabriel <span dir="ltr"><<a href="mailto:davidgab283@gmail.com" target="_blank">davidgab283@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="m_4121009849930676061m_2982919140730080456m_8345829170647907143m_-7208530353036770600h5"><div dir="ltr">Dears,<div><br></div><div>I need to generate the .pem file based on certifcate files (.cert).</div><div>The key (.key file) is available too.</div><div>All my files can be read as text files.</div><div>Could you please detail the procedure for this ?</div><div>I am using ubuntu as OS.</div><div><br></div><div>Thanks in advance.</div><div>Best regards.</div></div>
<br></div></div>______________________________<wbr>______________________________<wbr>______________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.op<wbr>enstack.org?subject:unsubscrib<wbr>e</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi<wbr>-bin/mailman/listinfo/openstac<wbr>k-dev</a><br>
<br></blockquote></div><span class="m_4121009849930676061m_2982919140730080456m_8345829170647907143m_-7208530353036770600HOEnZb"><font color="#888888"><br><br clear="all"><br>-- <br><div class="m_4121009849930676061m_2982919140730080456m_8345829170647907143m_-7208530353036770600m_-6842621909536337160gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><font style="font-family:arial narrow,sans-serif;color:rgb(102,102,102)" size="2">Juan Antonio Osorio R.<br>e-mail: <a href="mailto:jaosorior@gmail.com" target="_blank">jaosorior@gmail.com</a><br></font><font style="font-family:arial narrow,sans-serif;color:rgb(102,102,102)" size="2"><br></font></div></div></div>
</font></span></div>
<br></div></div>______________________________<wbr>_________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi<wbr>-bin/mailman/listinfo/openstac<wbr>k</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi<wbr>-bin/mailman/listinfo/openstac<wbr>k</a><br>
<br></blockquote></div><br></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br><br clear="all"><span class="HOEnZb"><font color="#888888"><br>-- <br><div class="m_4121009849930676061m_2982919140730080456gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><font style="font-family:arial narrow,sans-serif;color:rgb(102,102,102)" size="2">Juan Antonio Osorio R.<br>e-mail: <a href="mailto:jaosorior@gmail.com" target="_blank">jaosorior@gmail.com</a><br></font><font style="font-family:arial narrow,sans-serif;color:rgb(102,102,102)" size="2"><br></font></div></div></div>
</font></span></div>
</div></div></blockquote></div><br></div>
</blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><font style="font-family:arial narrow,sans-serif;color:rgb(102,102,102)" size="2">Juan Antonio Osorio R.<br>e-mail: <a href="mailto:jaosorior@gmail.com" target="_blank">jaosorior@gmail.com</a><br></font><font style="font-family:arial narrow,sans-serif;color:rgb(102,102,102)" size="2"><br></font></div></div></div>
</div></div>