<p>Pierre,</p>
<p>In Diablo and Essex it is a common deployment pattern to serve Keystone via SSL proxy or run Keystone as a mod_wsgi application directly. Running like this provides connection security between the clients and the Keystone server. </p>
<p>Adam Young provided a good example of doing this via Apache httpd on a blog post of his: <a href="http://adam.younglogic.com/2012/04/keystone-httpd/">http://adam.younglogic.com/2012/04/keystone-httpd/</a></p>
<p>Best,</p>
<p>Nate</p>
<div class="gmail_quote">On Aug 3, 2012 5:23 AM, "Pierre Amadio" <<a href="mailto:pierre.amadio@canonical.com">pierre.amadio@canonical.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi there !<br>
<br>
I have an essex install that works, and am trying now to do the same<br>
thing but with SSL for keystone communication.<br>
<br>
I am using Ubuntu 12.04<br>
<br>
I followed <a href="http://docs.openstack.org/developer/keystone/configuration.html" target="_blank">http://docs.openstack.org/developer/keystone/configuration.html</a><br>
<br>
On a remote box that will serve as my CA, i generated an auto signed<br>
root certificate:<br>
<br>
cd /etc/ssl<br>
sudo /usr/lib/ssl/misc/CA.pl -newca<br>
<br>
This generated a /etc/ssl/demoCA/cacert.pem file wich i think is to copy<br>
on my keystone node wherever ca_certs in the config file points to. Right ?<br>
<br>
So i have stored this file on /etc/ssl/cacert.pem<br>
<br>
On my keystone box, i generate a certificate request:<br>
<br>
sudo openssl req -nodes -out keystone-req.pem -new -newkey rsa:2048<br>
-keyout cert.key -days 1095<br>
sudo mv cert.key /etc/ssl/<br>
sudo chmod 0600 /etc/ssl/cert.key<br>
<br>
I send a copy of kesytone-req.pem on my CA box and sign it:<br>
<br>
cd /etc/ssl<br>
sudo openssl ca -policy policy_anything -out keystone-cert.crt -infiles<br>
keystone-req.pem<br>
<br>
I copy back the signed keystone-cert.crt file on my keystone box in<br>
/etc/ssl/keystone-cert.crt<br>
<br>
I add the following on /etc/keystone/kesytone.conf :<br>
<br>
[ssl]<br>
enable = True<br>
certfile = /etc/ssl/keystone-cert.crt<br>
keyfile = /etc/ssl/cert.key<br>
ca_certs = /etc/ssl/cacert.pem<br>
cert_required = True<br>
<br>
>From there, i was expecting to "just" have to restart keystone and start<br>
using the keystone client with a https SERVICE_ENDPOINT environment<br>
variable so i could create services, tenants, users and so on.<br>
<br>
However, it looks to me like keystone is not even trying to negociate a<br>
ssl handshake:<br>
<br>
$ export SERVICE_ENDPOINT=<a href="https://192.168.122.3:35357/v2.0/" target="_blank">https://192.168.122.3:35357/v2.0/</a><br>
$ export SERVICE_TOKEN=whatever<br>
$ keystone user-list<br>
<br>
No handlers could be found for logger "keystoneclient.client"<br>
Unable to communicate with identity service: [Errno 1] _ssl.c:504:<br>
error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol.<br>
(HTTP 400)<br>
<br>
>From a tcpdump:<br>
<br>
#########################################<br>
...........P....e...O..........4..6w....q}...V...<br>
.".!.9.8.........5............... ...<br>
.........3.2.....E.D...../...A..................I.........<br>
.4.2... ...........<br>
...................................#.......<head><br>
<title>Error response</title><br>
</head><br>
<body><br>
<h1>Error response</h1><br>
<p>Error code 400.<br>
<p>Message: Bad request syntax<br>
('\x16\x03\x01\x00\xcd\x01\x00\x00\xc9\x03\x02P\x1b\x86\x7f\xaee\x03\xb9\x88O\x9b\xf9\xa6\xff\x85\xea\xe8\xf7\x9e\xe64\x8f\xc86w\xa1\xd7\xb6\xc3q}\x03\x00\x00V\xc0\x14\xc0').<br>
<p>Error code explanation: 400 = Bad request syntax or unsupported method.<br>
</body><br>
##########################################<br>
<br>
I do not understand what i am doing wrong, nor am i 100% sure this is<br>
suppose to work yet.<br>
<br>
According to the following blue print, i think it should be available in<br>
essex:<br>
<br>
<a href="https://blueprints.launchpad.net/keystone/+spec/2-way-ssl" target="_blank">https://blueprints.launchpad.net/keystone/+spec/2-way-ssl</a><br>
<br>
At the bottom of the blueprint, there are 2 "addressed by" links with a<br>
set of patches:<br>
<br>
<a href="https://review.openstack.org/1038" target="_blank">https://review.openstack.org/1038</a><br>
<a href="https://review.openstack.org/7706" target="_blank">https://review.openstack.org/7706</a><br>
<br>
But i do not find trace of those patches in the ubuntu package<br>
<br>
ii keystone<br>
2012.1+stable~20120608-aff45d6-0ubuntu1 OpenStack identity service - Daemons<br>
ii python-keystone<br>
2012.1+stable~20120608-aff45d6-0ubuntu1 OpenStack identity service -<br>
Python library<br>
ii python-keystoneclient 2012.1-0ubuntu1<br>
Client libary for Openstack Keystone API<br>
<br>
I also fail to find trace of those in a git checkout of the<br>
refs/heads/stable/essex branch of keystone's git repository.<br>
<br>
I am confused.<br>
<br>
Any help would be appreciated.<br>
<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
</blockquote></div>