Cloudify 3.3 - Openstack:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

Question

I'm trying to create a Cloudify Manager into OpenStack with Keystone using HTTPS connection.

When I execute the command:

cfy bootstrap --install-plugins -p /path/to/manager/blueprint/file -i /path/to/inputs/yaml/file

I receive the following error:

raise exceptions.SslCertificateValidationError(reason=e) SslCertificateValidationError: SSL certificate validation has failed: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed 2016-01-29 09:50:58 CFY [external_network_5bbde.creation] Task failed 'neutron_plugin.network.creation_validation' -> SSL certificate validation has failed: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed [attempt 1/6]

What should I do to solve the problem?

Answer 1

I solved inserting, into the dsl_definition of the OpenStack blueprint:

dsl_definitions: 
 openstack_configuration: &openstack_configuration
  username: { get_input: keystone_username }
  password: { get_input: keystone_password }
  tenant_name: { get_input: keystone_tenant_name }
  auth_url: { get_input: keystone_url }
  region: { get_input: region }
  nova_url: { get_input: nova_url }
  neutron_url: { get_input: neutron_url }

the following statement:

custom_configuration:
 nova_client:
  insecure: true
 keystone_client:
  insecure: true
 neutron_client:
  insecure: true
 cinder_client:
  insecure: true

so that the final result was:

dsl_definitions:
 openstack_configuration: &openstack_configuration
  username: { get_input: keystone_username }
  password: { get_input: keystone_password }
  tenant_name: { get_input: keystone_tenant_name }
  auth_url: { get_input: keystone_url }
  region: { get_input: region }
  nova_url: { get_input: nova_url }
  neutron_url: { get_input: neutron_url }
  custom_configuration:
   nova_client:
    insecure: true
   keystone_client:
    insecure: true
   neutron_client:
    insecure: true
   cinder_client:
    insecure: true

Answer 2

It seems that you have a problem with the keystone SSL certificate.

You should either import the certificate to your CLI machine.

Or you could try before bootstrap to run:

export CLOUDIFY_SSL_TRUST_ALL=true;