Hi Hyunwoo<div><br></div><div>Thanks very much for looking into this. I've filled an issue[1] to include that option as part of the CLI command.</div><div><br></div><div>Thanks again for your great feedback</div><div><br>
</div><div>Cheers</div><div><br></div><div>Ruben</div><div><br></div><div><a href="http://dev.opennebula.org/issues/1485">http://dev.opennebula.org/issues/1485</a><br><br><div class="gmail_quote">On Mon, Sep 17, 2012 at 11:23 PM, Hyun Woo Kim <span dir="ltr"><<a href="mailto:hyunwoo@fnal.gov" target="_blank">hyunwoo@fnal.gov</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
I found out that modifying EC2QueryClient.rb to add<br>
connection.ssl_verify_peer = false<br>
relieves econe-upload of the error message(SSLCACertificateError.<br>
<br>
Thanks<br>
Hyunwoo<br>
<div><div class="h5"><br>
On Sep 14, 2012, at 11:40 PM, Hyun Woo Kim wrote:<br>
<br>
> Hi,<br>
> Please ignore the previous question.<br>
> I have more understanding of econe- commands (at the moment I am using econe-upload)<br>
> and I am getting a new error.<br>
><br>
> When I do the following,<br>
> econe-upload --url <a href="https://example.com:8443" target="_blank">https://example.com:8443</a> /path/name/image.img<br>
> (econe-server is running in the same host, <a href="http://example.com" target="_blank">example.com</a>)<br>
><br>
> I am getting the following error messages,<br>
> /usr/lib/ruby/gems/1.8/gems/curb-0.8.1/lib/curl/easy.rb:60:<br>
> in `perform': Curl::Err::SSLCACertificateError (Curl::Err::SSLCACertificateError)<br>
> from /home/onemod/lib/ruby/cloud/econe/EC2QueryClient.rb:166:in `http_post'<br>
> from /home/onemod/lib/ruby/cloud/econe/EC2QueryClient.rb:166:in `upload_image'<br>
> from /home/onemod/bin/econe-upload:119<br>
><br>
> My guess is that, econe-upload and Curl::Easy tries to verify the target(<a href="https://example.com" target="_blank">https://example.com</a>)<br>
> and for that purpose, it needs to know the location of CA that signed <a href="http://example.com" target="_blank">example.com</a>'s host certificate.<br>
> In <a href="http://example.com" target="_blank">example.com</a>, the CA certificate exists.<br>
><br>
> I even tried the followings;<br>
> 1. modify EC2QueryClient.rb :<br>
> - add connection.ssl_verify_host = 0<br>
> below connection = Curl::Easy.new(@uri.to_s)<br>
> (Curl::Easy has ssl_verify_host= method)<br>
> 2. or download cacert.pem from <a href="http://curl.haxx.se" target="_blank">curl.haxx.se</a> and modify EC2QueryClient.rb as<br>
> connection.cacert = File.join("/path/name/", "cacert.pem")<br>
><br>
> All these fail..<br>
> What is wrong with my econe configuration?<br>
> How can I make econe-upload aware of the location of CA certificate?<br>
><br>
> My general configurations are as follows..<br>
><br>
> $ONE_LOCATION/etc/auth/x509_auth.conf has<br>
> :ca_dir: "/etc/grid-security/certificates"<br>
><br>
> $ONE_LOCATION/etc/auth/server_x509_auth.conf has<br>
> :srv_user: serveradmin<br>
> :one_cert: "/etc/grid-security/hostcert.pem"<br>
> :one_key: "/etc/grid-security/hostkey.pem"<br>
><br>
> Thanks in advance<br>
> Hyunwoo<br>
><br>
> ________________________________________<br>
> From: <a href="mailto:users-bounces@lists.opennebula.org">users-bounces@lists.opennebula.org</a> [<a href="mailto:users-bounces@lists.opennebula.org">users-bounces@lists.opennebula.org</a>] on behalf of Hyun Woo Kim [<a href="mailto:hyunwoo@fnal.gov">hyunwoo@fnal.gov</a>]<br>
> Sent: Friday, September 14, 2012 5:42 PM<br>
> To: Ruben S. Montero<br>
> Cc: <a href="mailto:users@lists.opennebula.org">users@lists.opennebula.org</a><br>
> Subject: Re: [one-users] econe-server with x509 and econe command<br>
><br>
> Hi,<br>
><br>
> Thanks very much for the response.<br>
><br>
> Our econe server is already configured to use SSL proxy.<br>
> We are using mod_gridsite.<br>
> This module works just fine with sunstone server.<br>
><br>
> My question can be rephrased as follows.<br>
><br>
> As you mentioned, HTTP_SSL_CLIENT_CERT is set during SSL handshake.<br>
> This I understand.<br>
><br>
> What I do not understand is, my client which is econe-upload does not specify<br>
> my certificate and private key like I use wget --certificate --private-key.<br>
> I tried econe-upload --access-key=mycertificate --secret-key=myprivatekey or so.<br>
><br>
> How can a SSL handshake take place between Apache and econe-upload<br>
> when econe-upload does not know my certificate and private key?<br>
><br>
> Thanks again.<br>
> Hyunwoo<br>
> ________________________________<br>
> From: Ruben S. Montero [<a href="mailto:rsmontero@opennebula.org">rsmontero@opennebula.org</a>]<br>
> Sent: Friday, September 14, 2012 5:19 PM<br>
> To: Hyun Woo Kim<br>
> Cc: <a href="mailto:users@lists.opennebula.org">users@lists.opennebula.org</a><br>
> Subject: Re: [one-users] econe-server with x509 and econe command<br>
><br>
> Hi<br>
><br>
> The HTTP_SSL_CLIENT_CERT variable should be set by the Web server as a result of the SSL handshake. The econe server should be configured through a SSL proxy [1]<br>
><br>
> Cheers<br>
><br>
> ruben<br>
><br>
> [1] <a href="http://opennebula.org/documentation:rel3.6:ec2qcg#configuring_a_ssl_proxy" target="_blank">http://opennebula.org/documentation:rel3.6:ec2qcg#configuring_a_ssl_proxy</a><br>
><br>
> On Fri, Sep 14, 2012 at 10:41 PM, Hyun Woo Kim <<a href="mailto:hyunwoo@fnal.gov">hyunwoo@fnal.gov</a><mailto:<a href="mailto:hyunwoo@fnal.gov">hyunwoo@fnal.gov</a>>> wrote:<br>
> Dear developers,<br>
><br>
> $ONE_LOCATION/etc/econe.conf has<br>
> :auth: x509<br>
><br>
> I understand this eventually causes<br>
> do_auth in $ONE_LOCATION/lib/ruby/cloud/CloudAuth/X509CloudAuth.rb<br>
> to be invoked.<br>
><br>
> This code X509CloudAuth.rb has<br>
> cert_line = env['HTTP_SSL_CLIENT_CERT']<br>
> at the beginning,<br>
><br>
> but, it is empty.<br>
><br>
> For this test, I am using econe-upload command with the following options<br>
> econe-upload -M<br>
> --access-key "my account name"<br>
> --secret-key "the DN of my certificate"<br>
> --url <a href="https://hostname:8443" target="_blank">https://hostname:8443</a> (this is our site-specific)<br>
> pathname to image file<br>
><br>
><br>
> I think this result (HTTP_SSL_CLIENT_CERT being empty) is natural<br>
> because the command econe-upload does not point to my actual certificate..<br>
><br>
> Could you please clarify on how to use x509 auth with econe?<br>
><br>
> Thank you in advance.<br>
> Hyunwoo<br>
><br>
><br>
><br>
> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@lists.opennebula.org">Users@lists.opennebula.org</a><mailto:<a href="mailto:Users@lists.opennebula.org">Users@lists.opennebula.org</a>><br>
> <a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a><br>
><br>
><br>
><br>
><br>
> --<br>
> Ruben S. Montero, PhD<br>
> Project co-Lead and Chief Architect<br>
> OpenNebula - The Open Source Solution for Data Center Virtualization<br>
> <a href="http://www.OpenNebula.org" target="_blank">www.OpenNebula.org</a><<a href="http://www.OpenNebula.org" target="_blank">http://www.OpenNebula.org</a>> | <a href="mailto:rsmontero@opennebula.org">rsmontero@opennebula.org</a><mailto:<a href="mailto:rsmontero@opennebula.org">rsmontero@opennebula.org</a>> | @OpenNebula<br>
> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@lists.opennebula.org">Users@lists.opennebula.org</a><br>
</div></div>> <a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a><br>
<br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Ruben S. Montero, PhD<br>Project co-Lead and Chief Architect<br>OpenNebula - The Open Source Solution for Data Center Virtualization<br><a href="http://www.OpenNebula.org" target="_blank">www.OpenNebula.org</a> | <a href="mailto:rsmontero@opennebula.org" target="_blank">rsmontero@opennebula.org</a> | @OpenNebula<br>
</div>