Here is what I see: # python -mrequests.certs /usr/lib/python2.7/site-packages/requests/cacert.pem
I do see GeoTrust certs in here: -- # grep -i geotrust cacert.pem | head -2 # Issuer: CN=GeoTrust Global CA O=GeoTrust Inc. # Subject: CN=GeoTrust Global CA O=GeoTrust Inc. # grep -i geotrust cacert.pem | wc -l 21 -- Here is the requests.get output: -- # python Python 2.7.5 (default, Jun 24 2015, 00:41:19) [GCC 4.8.3 20140911 (Red Hat 4.8.3-9)] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import requests >>> requests.get("https://xxx.yyy.com:5000") /usr/lib/python2.7/site-packages/requests/packages/urllib3/util/ssl_.py:315: SNIMissingWarning: An HTTPS request has been made, but the SNI (Subject Name Indication) extension to TLS is not available on this platform. This may cause the server to present an incorrect TLS certificate, which can cause validation failures. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#snimissingwarning. SNIMissingWarning /usr/lib/python2.7/site-packages/requests/packages/urllib3/util/ssl_.py:120: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning . InsecurePlatformWarning Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib/python2.7/site-packages/requests/api.py", line 67, in get return request('get', url, params=params, **kwargs) File "/usr/lib/python2.7/site-packages/requests/api.py", line 53, in request return session.request(method=method, url=url, **kwargs) File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 468, in request resp = self.send(prep, **send_kwargs) File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 576, in send r = adapter.send(request, **kwargs) File "/usr/lib/python2.7/site-packages/requests/adapters.py", line 447, in send raise SSLError(e, request=request) requests.exceptions.SSLError: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed >>> -- Looks like if the geotrust chain exists then it should not have a problem with our ssl cert. What am I missing here? Thanks for your help with this! On Tue, Mar 22, 2016 at 6:14 PM, Rahul Sharma <rahulsharma...@gmail.com> wrote: > Python's requests module is unable to verify the cert. To check the > default location of trusted root ca used by requests module, run this > command: > > bash# python -mrequests.certs > > It will give you some location in output. Dump the contents of > GeoTrust_CA_Bundle.crt > to the end of this file. > > To test if its working fine, use these steps:- > [bash]$ python > Python 2.7.5 > Type "help", "copyright", "credits" or "license" for more information. > >>> import requests > >>> requests.get("https://xxx.yyy.com:5000") > <Response [300]> > >>> > > Instead of response 300, if you are still getting error here, it means the > cert is not correct or its unable to find the rootCA in the provided > location. > > *Rahul Sharma* > *MS in Computer Science, 2016* > College of Computer and Information Science, Northeastern University > Mobile: 801-706-7860 > Email: rahulsharma...@gmail.com > > On Tue, Mar 22, 2016 at 8:41 PM, Jagga Soorma <jagg...@gmail.com> wrote: > >> However my mac os x desktop does that without any issues. I was able >> to get around this on my CentOS server by downloading the >> GeoTrust_CA_Bundle.crt locally and using "export >> OS_CACERT=/var/tmp/GeoTrust_CA_Bundle.crt". However, I don't want to >> have all my users to have to do this. Is there a way around this on >> CentOS/Ubunut? I thought this would be part of the ssl chain included >> on these distributions. >> >> Thanks >> >> On Tue, Mar 22, 2016 at 5:38 PM, CHOW Anthony >> <anthony.c...@al-enterprise.com> wrote: >> > It seems like your CentOS 7 server is not able to verify the KeyStone >> server's certificate. >> > >> > [Errno 1] _ssl.c:504: error:14090086:SSL >> routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed >> > >> > Interesting issue. >> > >> > Anthony. >> > -----Original Message----- >> > From: Jagga Soorma [mailto:jagg...@gmail.com] >> > Sent: Tuesday, March 22, 2016 5:18 PM >> > To: openstack >> > Subject: [Openstack] SSL cert issue on openstack client >> > >> > Hi Guys, >> > >> > I am new to openstack and currently have a openstack environment that >> seems to have ssl enabled. From my mac I am able to use the openstack api >> without any issues and without having to do anything for ssl. >> > However, from my CentOS 7.1 server I get the following error message: >> > >> > -- >> > bash-4.2$ openstack image list >> > Discovering versions from the identity service failed when creating the >> password plugin. Attempting to determine version from URL. >> > SSL exception connecting to https://xxx.yyy.com:5000/v3/auth/tokens: >> > [Errno 1] _ssl.c:504: error:14090086:SSL >> routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed >> > -- >> > >> > I do seem to have the ca certificates installed: >> > >> > -- >> > $ rpm -qa | grep -i ca-cert >> > ca-certificates-2015.2.4-70.0.el7_1.noarch >> > -- >> > >> > Is there something extra that I need to do in order to get the >> openstack api working on CentOS? >> > >> > Not having much luck with this. Any help would be appreciated. >> > >> > Thanks! >> > >> > _______________________________________________ >> > Mailing list: >> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack >> > Post to : openstack@lists.openstack.org >> > Unsubscribe : >> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack >> >> _______________________________________________ >> Mailing list: >> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack >> Post to : openstack@lists.openstack.org >> Unsubscribe : >> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack >> > >
_______________________________________________ Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack Post to : openstack@lists.openstack.org Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack