Question

我创建了一个KeyStone实例，如下所示：

import cherrypy    
from keystoneauth1 import session as session
from keystoneclient.v3 import client as client
from keystoneauth1.identity import v3

auth = v3.Password(auth_url = KEYSTONE_URL, username = cherrypy.session['username'], password = cherrypy.session['password'], user_domain_name=OPENSTACK_DEFAULT_DOMAIN, project_name = 'admin', project_id = 'c9aee696c4b54f12a645af2c951327dc', project_domain_name = 'default')
sess = session.Session(auth=auth)
keystoneClient = client.Client(session=sess)

当我执行此代码时：

projectList = keystoneClient.projects.list()
print projectList

发生以下错误：

    HTTP Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/cherrypy/_cprequest.py", line 656, in respond
    response.body = self.handler()
  File "/usr/lib/python2.7/site-packages/cherrypy/lib/encoding.py", line 188, in __call__
    self.body = self.oldhandler(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/cherrypy/lib/jsontools.py", line 61, in json_handler
    value = cherrypy.serving.request._json_inner_handler(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/cherrypy/_cpdispatch.py", line 34, in __call__
    return self.callable(*self.args, **self.kwargs)
  File "/var/www/frontend/controllers/api/user.py", line 58, in PUT
    projectList = keystoneClient.projects.list()
  File "/usr/lib/python2.7/site-packages/positional/__init__.py", line 101, in inner
    return wrapped(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/v3/projects.py", line 107, in list
    **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 75, in func
    return f(*args, **new_kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 383, in list
    self.collection_key)
  File "/usr/lib/python2.7/site-packages/keystoneclient/base.py", line 124, in _list
    resp, body = self.client.get(url, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 173, in get
    return self.request(url, 'GET', **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 331, in request
    resp = super(LegacyJsonAdapter, self).request(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/adapter.py", line 98, in request
    return self.session.request(url, method, **kwargs)
  File "/usr/lib/python2.7/site-packages/positional/__init__.py", line 101, in inner
    return wrapped(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 387, in request
    auth_headers = self.get_auth_headers(auth)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 647, in get_auth_headers
    return auth.get_headers(self, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/plugin.py", line 84, in get_headers
    token = self.get_token(session)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/identity/base.py", line 90, in get_token
    return self.get_access(session).auth_token
  File "/usr/lib/python2.7/site-packages/keystoneauth1/identity/base.py", line 136, in get_access
    self.auth_ref = self.get_auth_ref(session)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/identity/v3/base.py", line 167, in get_auth_ref
    authenticated=False, log=False, **rkwargs)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 595, in post
    return self.request(url, 'POST', **kwargs)
  File "/usr/lib/python2.7/site-packages/positional/__init__.py", line 101, in inner
    return wrapped(*args, **kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 469, in request
    resp = send(**kwargs)
  File "/usr/lib/python2.7/site-packages/keystoneauth1/session.py", line 507, in _send_request
    raise exceptions.SSLError(msg)
SSLError: SSL exception connecting to https://dev-openstack.nubes.rl.ac.uk:5000/v3/auth/tokens: HTTPSConnectionPool(host='dev-openstack.nubes.rl.ac.uk', port=5000): Max retries exceeded with url: /v3/auth/tokens (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)",),))

无论我是这样做还是使用Nova列出正在运行的虚拟机，都会出现同样的情况，所以我认为它可能与验证有关，尽管我可能错了。我想了解：

为什么会这样？
我需要做些什么来工作？

Answer 1

错误似乎很清楚：＆＃34;证书验证失败＆＃34;。您有SSL证书验证问题。您需要将可信CA证书放在requests库（由所有OpenStack客户端用于HTTP操作）中找到它，这可能是操作系统和分发特定的。

如果安装了Python certifi模块，requests将使用它来查找CA证书包。如果您的发行版适当地自定义certifi，它将指向其他系统工具使用的同一证书包。例如，在我的（Fedora）系统上：

>>> import certifi
>>> certifi.where()
'/etc/pki/tls/certs/ca-bundle.crt'

如果certifi可用，但尚未由您的发行版进行自定义，则CA捆绑包将是cacert.pem模块目录中包含的文件certifi。

如果certifi不可用，则requests将默认使用位于cacert.pem模块目录中的requests。

您的工作是（a）确定正在使用哪些CA捆绑包，然后（b）安装用于将openstack SSL证书签名到该文件中的CA证书。

或者，您可以将OS_CACERT环境文件设置为指向适当的证书包。

另见this bug

创建KeyStone实例时的OpenStack KeyStone SSL异常

1 个答案: