Thanks for the quick reply Aside from the manual listen_tls change... - hardcoded root/admin password inside the live-iso image - set a dynamic uuid to be generated for libvirtd.conf (our hardware reports the same across boxes using dmidecode otherwise) This executes just after ovirt-early starts in /usr/libexec/ovirt-init-functions.sh grep -w "^host_uuid" /etc/libvirt/libvirtd.conf || echo host_uid = \"`uuidgen`\" >> /etc/libvirt/libvirtd.conf - have been adding these systems using the engine webui /and entering node password- so don't connect to the server to authenticate certificate config details below # ls -l /etc/pki/CA/ -r--r--r--. 1 vdsm kvm 3412 Mar 29 08:39 cacert.pem drwxr-xr-x. 2 root root 40 Jan 19 16:37 certs drwxr-xr-x. 2 root root 40 Jan 19 16:37 crl drwxr-xr-x. 2 root root 40 Jan 19 16:37 newcerts drwx------. 2 root root 40 Jan 19 16:37 private # df |grep /etc/pki/vdsm/certs/cacert.pem /dev/mapper/HostVG-Config 7998 1298 6291 18% /etc/pki/vdsm/certs/cacert.pem # diff /etc/pki/vdsm/certs/cacert.pem /etc/pki/CA/cacert.pem # grep -v '^#' /etc/vdsm/vdsm.conf|grep "=" ssl=true # grep -v '^#' /etc/vdsm-reg/vdsm-reg.conf [vars] reg_req_interval = 5 vdsm_conf_file=/etc/vdsm/vdsm.conf pidfile=/var/run/vdsm-reg.pid logger_conf=/etc/vdsm-reg/logger.conf vdc_host_name=ovirt-m-1.shazamteam.com vdc_host_port=8443 vdc_reg_uri=/OvirtEngineWeb/register upgrade_iso_file=/data/updates/ovirt-node-image.iso upgrade_mount_point=/var/run/vdsm/image-update ticket= # grep -v '^#' /etc/libvirt/libvirtd.conf |grep '=' listen_tls = 1 listen_tcp = 1 listen_addr="0" # by vdsm unix_sock_group="kvm" # by vdsm unix_sock_rw_perms="0770" # by vdsm auth_unix_rw="sasl" # by vdsm save_image_format="lzop" # by vdsm log_outputs="1:file:/var/log/libvirtd.log" # by vdsm ca_file="/etc/pki/vdsm/certs/cacert.pem" # by vdsm cert_file="/etc/pki/vdsm/certs/vdsmcert.pem" # by vdsm key_file="/etc/pki/vdsm/keys/vdsmkey.pem" # by vdsm # grep -v '^#' /etc/libvirt/qemu.conf |grep -v '^#'|grep = vnc_listen = "0.0.0.0" dynamic_ownership=0 # by vdsm spice_tls=1 # by vdsm spice_tls_x509_cert_dir="/etc/pki/vdsm/libvirt-spice" # by vdsm Cheers, Dave -----Original Message----- From: Doron Fediuck [mailto:dfediuck@redhat.com] Sent: 29 March 2012 16:51 To: David Elliott Cc: users(a)ovirt.org Subject: Re: [Users] Ovirt Node - tls VM Migration Fails On 29/03/12 17:23, David Elliott wrote: has the isn't Let's just verify first what libvirt is saying. Can you please post the output of: ls -l /etc/pki/CA/ Also, AFAIR, it should be using /etc/pki/vdsm/certs/cacert.pem Can you take a look in the relevant config files (vdsm mostly) and see how it's defined? Did you happen to manually change it? ______________________________________________________________________ This email has been scanned by the Symantec Email Security.cloud service. For more information please visit http://www.symanteccloud.com ______________________________________________________________________ ______________________________________________________________________ This email has been scanned by the Symantec Email Security.cloud service. For more information please visit http://www.symanteccloud.com ______________________________________________________________________