puppet-openstack-integration

Update SSL certificates with SubjectAltNames A recent update to urllib tightened some checks around SSL [1]. This prompted an update to Devstack in order to work properly [2]. Jobs running into this problem without having a SubjectAltName provided will see an error that looks like: SSLError: hostname '127.0.0.1' doesn't match either of '127.0.0.1', 'localhost' Let's also update the certificates to provide the SubjectAltName and provide a way to easily update the certificates if required in the future. [1]: https://github.com/shazow/urllib3/blob/df9d503a8ea767e8a2ee95b3e75a914480c93de6/CHANGES.rst#118-2016年09月26日 [2]: https://git.openstack.org/cgit/openstack-dev/devstack/commit/?id=69e3c0aac99981f17c76c22111e5c397824b8428 Change-Id: I94a586b333ba6a99ef831c853a19ab127b502d6f

2016年09月28日 17:15:16 -04:00

# Generate key and create a self-signed certificate:

# $ openssl req \

# -x509 \

# -config ssl-ipv6.conf \

# -newkey rsa:2048 \

# -keyform PEM \

# -out ipv6.crt \

# -outform PEM \

New SSL certificates Current SSL certificates have expired. This patch contain new ones valid for 10 years and i've updated the ssl-ipv*.conf with the command to create certificates with this expiration time. Change-Id: Iaf4164149e3e28de8cf0367bc98e3e649bd10f87

2016年10月29日 18:11:34 -04:00

# -days 3650 \

Update SSL certificates with SubjectAltNames A recent update to urllib tightened some checks around SSL [1]. This prompted an update to Devstack in order to work properly [2]. Jobs running into this problem without having a SubjectAltName provided will see an error that looks like: SSLError: hostname '127.0.0.1' doesn't match either of '127.0.0.1', 'localhost' Let's also update the certificates to provide the SubjectAltName and provide a way to easily update the certificates if required in the future. [1]: https://github.com/shazow/urllib3/blob/df9d503a8ea767e8a2ee95b3e75a914480c93de6/CHANGES.rst#118-2016年09月26日 [2]: https://git.openstack.org/cgit/openstack-dev/devstack/commit/?id=69e3c0aac99981f17c76c22111e5c397824b8428 Change-Id: I94a586b333ba6a99ef831c853a19ab127b502d6f

2016年09月28日 17:15:16 -04:00

# -nodes

#

[ req ]

default_bits = 2048

default_keyfile = ipv6.key

default_md = sha256

prompt = no

distinguished_name = distinguished_name

req_extensions = v3_req

x509_extensions = v3_ca

[ v3_req ]

subjectAltName = @alt_names

[ v3_ca ]

basicConstraints = CA:TRUE

subjectKeyIdentifier = hash

authorityKeyIdentifier = keyid:always,issuer:always

subjectAltName = @alt_names

[alt_names]

IP.0 = ::1

Fix ipv6 certificate to make it compliant with IDNA Currently we are setting "DNS.0 = ::1", but ::1 is not a valid A-Label for IDNA so the certificate is not correct. Additionally, we are setting wrong value for DNS.0 = 127.0.0.1 in the ipv4 certificate. Finally, removing issuerAltName from both ipv4 and ipv6 certificates as they are not needed for the jobs. New versions of python-cryptography are more strict to check certificates content and does not allow to have not compliant DNS names so we need to fix the certificate to bump python-cryptography. Note that horizont tempest plugin does not support ipaddress SANs based certificate validation so I'm disablint certificate validation for dashboard in this patch. Depends-On: Iea7a4b85ac64572fac0f0ad871649a79fbc1c0f5 Change-Id: Ib519d222e07e26d3683b24359e2f67728cdd8029

2018年03月15日 16:37:14 +01:00

DNS.0 = localhost

Update SSL certificates with SubjectAltNames A recent update to urllib tightened some checks around SSL [1]. This prompted an update to Devstack in order to work properly [2]. Jobs running into this problem without having a SubjectAltName provided will see an error that looks like: SSLError: hostname '127.0.0.1' doesn't match either of '127.0.0.1', 'localhost' Let's also update the certificates to provide the SubjectAltName and provide a way to easily update the certificates if required in the future. [1]: https://github.com/shazow/urllib3/blob/df9d503a8ea767e8a2ee95b3e75a914480c93de6/CHANGES.rst#118-2016年09月26日 [2]: https://git.openstack.org/cgit/openstack-dev/devstack/commit/?id=69e3c0aac99981f17c76c22111e5c397824b8428 Change-Id: I94a586b333ba6a99ef831c853a19ab127b502d6f

2016年09月28日 17:15:16 -04:00

[ distinguished_name ]

commonName = ::1

countryName = US

stateOrProvinceName = North Carolina

localityName = Raleigh

organizationName = Red Hat Inc.

organizationalUnitName = OpenStack

openstack/puppet-openstack-integration - puppet-openstack-integration - OpenDev: Free Software Needs Free Tools

41 lines

921 B

Plaintext

Raw Normal View History

openstack/puppet-openstack-integration - puppet-openstack-integration - OpenDev: Free Software Needs Free Tools

41 lines 921 B Plaintext Raw Normal View History Unescape Escape

41 lines

921 B

Plaintext

Raw Normal View History