<html><head></head><body><div class="ydp593e014ayahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;"><div></div>
<div dir="ltr" data-setdir="false">Hi Mohammad,</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Thanks you for the reply. Below is the output of the command you sent:</div><div dir="ltr" data-setdir="false"><div><div><br></div><div>sudo -u nova stat /etc/letsencrypt/live/<MY_CONTROLLER_FQDN>/fullchain.pem </div><div> File: /etc/letsencrypt/live/<MY_CONTROLLER_FQDN>/fullchain.pem</div><div> Size: 5616 <span style="white-space: pre-wrap;"> </span>Blocks: 16 IO Block: 4096 regular file</div><div>Device: 802h/2050d<span style="white-space: pre-wrap;"> </span>Inode: 7340138 Links: 1</div><div>Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)</div><div>Access: 2021-06-04 15:47:48.544545426 +0100</div><div>Modify: 2021-06-03 11:50:26.410071017 +0100</div><div>Change: 2021-06-03 11:52:39.870554481 +0100</div><div> Birth: -</div></div><div><br></div><div dir="ltr" data-setdir="false">The permissions on the live directory are:</div><div dir="ltr" data-setdir="false"><br></div><div><div>ls -al /etc/letsencrypt/live/</div><div>total 16</div><div>drwx--x--x 3 root root 4096 Jun 3 11:53 .</div><div>drwxr-xr-x 9 root root 4096 Jun 3 11:50 ..</div><div>-rw-r--r-- 1 root root 740 Jun 3 11:50 README</div><div dir="ltr" data-setdir="false">drwxr-xr-x 2 root root 4096 Jun 3 11:50 <span><span style="color: rgb(0, 0, 0); font-family: Helvetica Neue, Helvetica, Arial, sans-serif;"><MY_CONTROLLER_FQDN></span></span></div></div><div><br></div><div dir="ltr" data-setdir="false">I changed the owner and group to nova as a test to see if that was the issue but it still didn't work. The first error I had was as you say a permissions issue on the live directory and as nova (su nova -s /bin/bash) I couldn't access that directory so I changed the permissions and tested it as the nova user (cd /etc/letsencrypt/live & cat fullchain.pem) and I could read the files in there. I then had the error I sent in the original email.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">The funny thing is I had a test deploy and it all worked fine but when I redeployed it on new machines with the same OS (ubuntu 20.04) it won't work for me. </div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Regards,</div><div dir="ltr" data-setdir="false">Derek</div><br></div><div><br></div>
</div><div id="yahoo_quoted_3301764242" class="yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Friday 4 June 2021, 19:59:31 IST, Mohammed Naser <mnaser@vexxhost.com> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div dir="ltr">Hi Derek,<br clear="none"><br clear="none">What's the permissions of the letsencrypt cert files and the user that<br clear="none">Nova is running on?<br clear="none"><br clear="none">sudo -u nova stat /etc/letsencrypt/live/ <MY_CONTROLLER_FQDN>/fullchain.pem<br clear="none"><br clear="none">Will probably fail, so you might wanna fix that!<br clear="none"><br clear="none">M<br clear="none"><div class="yqt8889204533" id="yqtfd03690"><br clear="none">On Fri, Jun 4, 2021 at 11:23 AM Derek O keeffe <<a shape="rect" ymailto="mailto:derekokeeffe85@yahoo.ie" href="mailto:derekokeeffe85@yahoo.ie">derekokeeffe85@yahoo.ie</a>> wrote:<br clear="none">><br clear="none">> Hi all,<br clear="none">><br clear="none">> This is my first post to this list so excuse me if I have not submitted correctly.<br clear="none">><br clear="none">> I have installed openstack Victoria manually as a multi node setup. A controller & 3 computes. Everything works fine and the way it's expected. I have secured horizon with letsencrypt certs (for now) and again all is fine. When I did a test deploy I also used those certs to load the novnc console securely and it worked.<br clear="none">><br clear="none">> My problem with my new deploy is that the console will not load no matter what I try. I get the following error when I enable debug mode in nova.<br clear="none">><br clear="none">> 2021-06-04 15:54:11.004 356545 ERROR nova.console.websocketproxy Traceback (most recent call last):<br clear="none">> 2021-06-04 15:54:11.004 356545 ERROR nova.console.websocketproxy File "/usr/lib/python3/dist-packages/websockify/websockifyserver.py", line 691, in top_new_client<br clear="none">> 2021-06-04 15:54:11.004 356545 ERROR nova.console.websocketproxy client = self.do_handshake(startsock, address)<br clear="none">> 2021-06-04 15:54:11.004 356545 ERROR nova.console.websocketproxy File "/usr/lib/python3/dist-packages/websockify/websockifyserver.py", line 578, in do_handshake<br clear="none">> 2021-06-04 15:54:11.004 356545 ERROR nova.console.websocketproxy context.load_cert_chain(certfile=self.cert, keyfile=self.key, password=self.key_password)<br clear="none">> 2021-06-04 15:54:11.004 356545 ERROR nova.console.websocketproxy PermissionError: [Errno 13] Permission denied<br clear="none">><br clear="none">> If I don't have debug enabled I just get the permission denied error. I have switched to the nova user and confirmed I can access the certs directory and read the certs. All my nova services are running fine as well.<br clear="none">><br clear="none">> My controller conf is the following:<br clear="none">> [default]<br clear="none">> ssl_only=true<br clear="none">> cert=/etc/letsencrypt/live/ <MY_CONTROLLER_FQDN>/fullchain.pem<br clear="none">> key=/etc/letsencrypt/live/ <MY_CONTROLLER_FQDN>/privkey.pem<br clear="none">><br clear="none">> [vnc]<br clear="none">> enabled = true<br clear="none">> server_listen = 0.0.0.0<br clear="none">> server_proxyclient_address = $my_ip<br clear="none">> novncproxy_base_url = https://<MY_CONTROLLER_FQDN>:6080/vnc_auto.html<br clear="none">><br clear="none">> My compute config is the following:<br clear="none">> [vnc]<br clear="none">> enabled = true<br clear="none">> server_listen = 0.0.0.0<br clear="none">> server_proxyclient_address = $my_ip<br clear="none">> novncproxy_base_url = https://<MY_CONTROLLER_FQDN>:6080/vnc_auto.html<br clear="none">><br clear="none">><br clear="none">> If anyone could help that would be really appreciated or any advice to further troubleshoot!! I cannot see anything else in any logs but I might not be looking in the right place. Thank you in advance.<br clear="none">><br clear="none">> Derek</div><br clear="none">><br clear="none">><br clear="none">><br clear="none"><br clear="none"><br clear="none">-- <br clear="none">Mohammed Naser<br clear="none">VEXXHOST, Inc.<div class="yqt8889204533" id="yqtfd86358"><br clear="none"><br clear="none"></div></div></div>
</div>
</div></body></html>