<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hi, <div>I'm facing a issue with cloudpipe that is driving me crazy. My cloudpipe vpn keys used to work for a tenant, but for one another, (regular) it doesn't work.</div><div>I basically create a certificate : </div><div>$ nova x509-create-cert</div><div><div>Wrote private key to pk.pem</div><div>Wrote x509 certificate to cert.pem</div><div><br></div><div>$ nova x509-get-root-cert</div><div>Wrote x509 root cert to cacert.pem</div><div><br></div><div>now if I verify both cert. and private key, they match : </div><div><div>$ openssl x509 -noout -modulus -in cert.pem | openssl md5</div><div>(stdin)= 93259863d334911d55be20db96709e66</div></div><div><br></div><div>$ openssl rsa -noout -modulus -in pk.key | openssl md5</div><div>(stdin)= 93259863d334911d55be20db96709e66</div><div><br></div><div>but if I want to verify the CA against the cert, then it doesn't match :</div><div>$ openssl verify -CAfile cacert.pem cert.pem</div><div>cert.pem: C = US, ST = California, O = OpenStack, OU = NovaDev, CN = 9b1ed48626fa46b7-2c3d0e28ec564cbe-2013-03-05T13:49:04Z</div><div>error 7 at 0 depth lookup:certificate signature failure</div><div>140284857550496:error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01:rsa_pk1.c:100:</div><div>140284857550496:error:04067072:rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed:rsa_eay.c:721:</div><div>140284857550496:error:0D0C5006:asn1 encoding routines:ASN1_item_verify:EVP lib:a_verify.c:221:</div><div><br></div><div>Thus I obtain the following errors in openvpn : </div><div><a href="http://paste.openstack.org/show/32787/">http://paste.openstack.org/show/32787/</a></div><div><br></div><div>If I verify the CA against the certs located in /var/lib/nova/CA/projects/ it works : </div><div>openssl verify -CAfile /var/lib/nova/CA/projects/$project-Id/cacert.pem /var/lib/nova/CA/projects/$project-Id/newcerts/14.pem</div><div>/var/lib/nova/CA/projects/9b1ed48626fa46b7b81f21ef21979069/newcerts/14.pem: OK</div><div><br></div><div>and the md5 seems good as well :</div><div>$ openssl x509 -noout -modulus -in /var/lib/nova/CA/projects/$project-id/newcerts/14.pem | openssl md5</div><div><br></div><div>But if I chose that certificate, I have the same errors...</div><div><br></div><div>Is there any way to reset all the tenants CA, and clean a bit ?(the nova certificates tables references files that are missing (/var/lib/nova/CA/projects/9b1ed48626fa46b7b81f21ef21979069/newcerts/17.pem is an entry while the file doesn't exist)</div><div>Best regards,</div><div>Razique</div><div><br></div><div><span class="Apple-style-span" style="font-family: Helvetica; "><b style="color: rgb(19, 112, 138); ">Razique Mahroua</b></span><span class="Apple-style-span" style="font-family: Helvetica; color: rgb(19, 112, 138); "><b> - </b></span><span class="Apple-style-span" style="font-family: Helvetica; "><b style="color: rgb(19, 112, 138); ">Nuage & Co</b></span></div><div apple-content-edited="true"><span class="Apple-style-span" style="border-collapse: separate; font-family: 'Lucida Grande'; border-spacing: 0px; "><span class="Apple-style-span" style="font-family: Helvetica; "><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><span class="Apple-style-span" style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; border-collapse: separate; border-spacing: 0px; -webkit-text-decorations-in-effect: none; "><span class="Apple-style-span" style="border-collapse: separate; font-variant: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div style="font-weight: normal; color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; "><font class="Apple-style-span" color="#13708a"><a href="mailto:razique.mahroua@gmail.com">razique.mahroua@gmail.com</a></font></div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: medium; font-style: normal; "><font class="Apple-style-span" color="#13708a">Tel : +33 9 72 37 94 15</font></div></span></span></span></span></span><br class="Apple-interchange-newline" style="color: rgb(0, 0, 0); font-family: Arial; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span><img height="125" width="125" id="0e852fc1-5d8b-4717-bd40-68423a811a99" apple-width="yes" apple-height="yes" src="cid:0A2450C8-6A0D-42D0-8035-743CAD564432@fabrique.lan"></span>
</div>
<br></div></body></html>