<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" id="owaParaStyle"></style>
</head>
<body fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Hi,
<div><br>
</div>
<div>Thanks very much for the response.</div>
<div><br>
</div>
<div>Our econe server is already configured to use SSL proxy.</div>
<div>We are using mod_gridsite.</div>
<div>This module works just fine with sunstone server.</div>
<div><br>
</div>
<div>My question can be rephrased as follows.</div>
<div><br>
</div>
<div>As you mentioned, HTTP_SSL_CLIENT_CERT is set during SSL handshake.</div>
<div>This I understand.</div>
<div><br>
</div>
<div>What I do not understand is, my client which is econe-upload does not specify</div>
<div>my certificate and private key like I use wget --certificate --private-key.</div>
<div>I tried econe-upload --access-key=mycertificate --secret-key=myprivatekey or so.</div>
<div><br>
</div>
<div>How can a SSL handshake take place between Apache and econe-upload</div>
<div>when econe-upload does not know my certificate and private key?</div>
<div><br>
</div>
<div>Thanks again.</div>
<div>Hyunwoo<br>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div id="divRpF123555" style="direction: ltr; "><font face="Tahoma" size="2" color="#000000"><b>From:</b> Ruben S. Montero [rsmontero@opennebula.org]<br>
<b>Sent:</b> Friday, September 14, 2012 5:19 PM<br>
<b>To:</b> Hyun Woo Kim<br>
<b>Cc:</b> users@lists.opennebula.org<br>
<b>Subject:</b> Re: [one-users] econe-server with x509 and econe command<br>
</font><br>
</div>
<div></div>
<div>Hi
<div><br>
</div>
<div>The HTTP_SSL_CLIENT_CERT variable should be set by the Web server as a result of the SSL handshake. The econe server should be configured through a SSL proxy [1]</div>
<div><br>
</div>
<div>Cheers</div>
<div><br>
</div>
<div>ruben</div>
<div><br>
</div>
<div>[1] <a href="http://opennebula.org/documentation:rel3.6:ec2qcg#configuring_a_ssl_proxy" target="_blank">http://opennebula.org/documentation:rel3.6:ec2qcg#configuring_a_ssl_proxy</a></div>
<div><br>
<div class="gmail_quote">On Fri, Sep 14, 2012 at 10:41 PM, Hyun Woo Kim <span dir="ltr">
<<a href="mailto:hyunwoo@fnal.gov" target="_blank">hyunwoo@fnal.gov</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
Dear developers,<br>
<br>
$ONE_LOCATION/etc/econe.conf has<br>
:auth: x509<br>
<br>
I understand this eventually causes<br>
do_auth in $ONE_LOCATION/lib/ruby/cloud/CloudAuth/X509CloudAuth.rb<br>
to be invoked.<br>
<br>
This code X509CloudAuth.rb has<br>
cert_line = env['HTTP_SSL_CLIENT_CERT']<br>
at the beginning,<br>
<br>
but, it is empty.<br>
<br>
For this test, I am using econe-upload command with the following options<br>
econe-upload -M<br>
--access-key "my account name"<br>
--secret-key "the DN of my certificate"<br>
--url <a href="https://hostname:8443" target="_blank">https://hostname:8443</a> (this is our site-specific)<br>
pathname to image file<br>
<br>
<br>
I think this result (HTTP_SSL_CLIENT_CERT being empty) is natural<br>
because the command econe-upload does not point to my actual certificate..<br>
<br>
Could you please clarify on how to use x509 auth with econe?<br>
<br>
Thank you in advance.<br>
Hyunwoo<br>
<br>
<br>
<br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opennebula.org" target="_blank">Users@lists.opennebula.org</a><br>
<a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a><br>
<br>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
Ruben S. Montero, PhD<br>
Project co-Lead and Chief Architect<br>
OpenNebula - The Open Source Solution for Data Center Virtualization<br>
<a href="http://www.OpenNebula.org" target="_blank">www.OpenNebula.org</a> | <a href="mailto:rsmontero@opennebula.org" target="_blank">
rsmontero@opennebula.org</a> | @OpenNebula<br>
</div>
</div>
</div>
</div>
</div>
</body>
</html>