I try to deploy an overcloud openstack in victoria version.

My configuration to deploy is :

openstack overcloud deploy --templates   -r /home/stack/templates/roles_data.yaml \
                                         -n /home/stack/network_data.yaml \
                                         -e /home/stack/templates/scheduler_hints_env.yaml \
                                         -e /home/stack/templates/network-isolation.yaml \
                                         -e /home/stack/templates/os-net-config-mapping.yaml \
                                         -e /home/stack/templates/node-info.yaml \
                                         -e /home/stack/containers-prepare-parameter.yaml \
                                         -e /home/stack/templates/host-map.yaml \
                                         -e /home/stack/templates/ips-from-pool-all.yaml \
                                         -e /home/stack/templates/network-environment.yaml \
                                         -e /home/stack/templates/net-multiple-nics-vlans.yaml \
                                         -e /home/stack/templates/ceph-ansible-external.yaml \
                                         -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-internal-tls.yaml \
                                         -e /usr/share/openstack-tripleo-heat-templates/environments/services/haproxy-internal-tls-certmonger.yaml \
                                         -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-endpoints-public-ip.yaml \
                                         -e /usr/share/openstack-tripleo-heat-templates/environments/services/octavia.yaml \
                                         -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-everywhere-endpoints-dns.yaml \
                                         -e /usr/share/openstack-tripleo-heat-templates/environments/disable-telemetry.yaml \
                                         -e /home/stack/templates/tls-parameters.yaml \
                                         -e /home/stack/templates/inject-trust-anchor.yaml \

  
The generated configuration of horizon httpd  contains SSLVerifyClient.
But Haproxy fails to check server available, because haproxy does not send a client certificate when check attempt.

the generated configuration of haproxy backend is :
server host1 ip_host1:5000 ca-file /etc/ipa/ca.crt check fall 5 inter 2000 rise 2 ssl verify required verifyhost host1
server host2 ip_host2:5000 ca-file /etc/ipa/ca.crt check fall 5 inter 2000 rise 2 ssl verify required verifyhost host2
server host3 ip_host3:5000 ca-file /etc/ipa/ca.crt check fall 5 inter 2000 rise 2 ssl verify required verifyhost host3

if i try adding manualy "crt /etc/pki/tls/certs/haproxy/overcloud-haproxy-internal_api.pem" in server configuration in haproxy.conf, horizon/dashboard works via haproxy. But i'm not sure that's the right way.

Did I forget an environment file in deploy configuration ?

Thank you in advance for your assistance with this.

Best regards

Souppart Alexandre