8:39 a.m.
I followed the guide here to replace the self-signed certs with 3rd party certs, and now
i'm getting this error on signin:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid
certification path to requested target
do i need to have the .p12 in place also? I extracted the .key and .cer from the existing
PFX, and copied them to all the places in the article, renaming the .cer to .pem as neded
and I always get that error. Yes, I did copy to the java directory and ran the program to
update the trust store, and I can list out the trust store and see it listed. Has there
been a recent change in how it handles certs? I tried it with the blank password for the
certstore, with "changeit" and also changing the password to "123456"
and none work.
6:22 p.m.
I fixed this 30 minutes after I posted this. So for anyone else that has this issue, It
turns out that the cert wan't getting imported after running the command "keytool
-import -alias ovirt -keystore ./cacerts -file <3rdpartycert>.cer" manually, as
"update-ca-trust" did not add it automatically. Also, the default password for
the keystore is "changeit", and I put the keystore password in the
"99-custom-truststore.conf" file, not the "" entry like the article
says.
7:22 p.m.
It appears I spoke too soon, even though I can now get into the ovirt portal, I can't
connect with the spice console. Even after recopying the cert and key over and restarting
the service.
5:51 a.m.
New subject: replaced ovirt certs, now i'm locked out with unable to find valid certification path
Hi,
On Sat, May 4, 2019 at 1:24 AM <michael(a)wanderingmad.com> wrote:
I fixed this 30 minutes after I posted this. So for anyone else that has this issue, It
turns out that the cert wan't getting imported after running the command "keytool
-import -alias ovirt -keystore ./cacerts -file <3rdpartycert>.cer" manually, as
"update-ca-trust" did not add it automatically. Also, the default password for
the keystore is "changeit", and I put the keystore password in the
"99-custom-truststore.conf" file, not the "" entry like the article
says.
Can you please elaborate?
I assume you refer to this doc:
[1] https://www.ovirt.org/documentation/admin-guide/appe-oVirt_and_SSL.html
I never tried configuring access to LDAP (TLS or not).
I think you either mix things a bit, or I fail to follow. In particular:
ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD should indeed usually be empty.
If you use a custom trust store for this, instead of the system-wide
/etc/pki/java/cacerts, it's indeed up to you - you can protect it with
a password, and then have to provide that password in this param.
"changeit" is the default password for the engine-internal truststore,
"/etc/pki/ovirt-engine/.truststore". But above procedure does not
suggest to add your 3rd-party CA cert there. If you need to, that's a
bug. We recently fixed such a bug:
https://bugzilla.redhat.com/1687301
"keytool -import -alias ovirt -keystore ./cacerts -file
<3rdpartycert>.cer" is mentioned only in the second part, about LDAP
access. It suggests to create another truststore, and use that in the
aaa configuration. You should indeed use the same password when
creating it and in the aaa conf (but do not need to do that in the
engine conf).
On Sat, May 4, 2019 at 2:23 AM <michael(a)wanderingmad.com> wrote:
It appears I spoke too soon, even though I can now get into the ovirt portal, I can't
connect with the spice console. Even after recopying the cert and key over and restarting
the service.
Please provide more details: What exactly did you change when trying
to use 3rd-party CA certs? What error do you get and where? What do
you see in relevant log files?
Thanks and best regards,
--
Didi
10:30 a.m.
This had nothing to do with LDAP or anything, just trying to change the cert to a 3rd
party signed one. Until I did those two steps I was unable to sign into the portal, as I
just had a java error every time, it had nothing to do with LDAP. For me, that SSL
document is really confusing because it's not clear how some parts of the certs
require full chain, some parts are just the actual 3rd party cert, and some parts it seems
like it says "CA" cert, does it mean the root cert? or does it just mean the
3rd party cert you're installing? does it require a p12 file? the article says
"we suggest storing .p12 here" but it doesn't say "you must put your
.p12 here".
Right now it works, sort of. I'm able to sign into portal, but i'm unable to
connect to any of the VM consoles. I don't know where to go from here, the article
says nothing about SPICE, is spice also supposed to work after the cert change? or is
that part of another article that we can't see? Is a cert placed wrong? When I try
to connect to a console, it errors out with "could not connect to server". The
log on the VM host says:
(process:31241): Spice-WARNING **: 14:04:43.782: reds-stream.c:469:reds_stream_ssl_accept:
SSL_accept failed, error=1
139940713029056:error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown
ca:s3_pkt.c:1493:SSL alert number 48
in the engine server.log:
2019-05-04 20:09:55,479-04 INFO [org.apache.commons.httpclient.HttpMethodBase]
(EE-ManagedThreadFactory-engine-Thread-14097) Response content length is not known
and the .vv file from ovirt looks like this, it has a private cert, for the host, but the
3rd part for the host? Is this right? What about a proxy? does that come into play?
Did i miss a cert?
[virt-viewer]
type=spice
host=172.16.x.x
port=5901
password=zYhIyn7/zVju
# Password is valid for 120 seconds.
delete-this-file=1
fullscreen=0
title=ADFSTwo:%d
toggle-fullscreen=shift+f11
release-cursor=shift+f12
secure-attention=ctrl+alt+end
tls-port=5902
enable-smartcard=0
enable-usb-autoshare=1
usb-filter=-1,-1,-1,-1,0
tls-ciphers=DEFAULT
host-subject=<private cert CA name>
ca=-----BEGIN
CERTIFICATE-----\nMIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkGA1UEBhMCQkUx\nGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jvb3QgQ0ExGzAZBgNVBAMTEkds\nb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAwMDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNV\nBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYD\nVQQDExJHbG9iYWxTaWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDa\nDuaZjc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavpxy0Sy6sc\nTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp1Wrjsok6Vjk4bwY8iGlb\nKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdGsnUOhugZitVtbNV4FpWi6cgKOOvyJBNP\nc1STE4U6G7weNLWLBYy5d4ux2x8gkasJU26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrX\ngzT/LCrBbBlDSgeF59N89iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV\nHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0BAQUF\nAAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOzyj1hTdNGCbM+w6Dj\nY1Ub8rrvrTnhQ7k4o+YviiY776BQVv
nGCv04zcQLcFGUl5gE38NflNUVyRRBnMRddWQVDf9VMOyG\nj/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymPAbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhH\nhm4qxFYxldBniYUr+WymXUadDKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveC\nX4XSQRjbgbMEHMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==\n-----END
CERTIFICATE-----\n
secure-channels=main;inputs;cursor;playback;record;display;smartcard;usbredir
versions=rhev-win64:2.0-160;rhev-win32:2.0-160;rhel7:2.0-6;rhel6:99.0-1
newer-version-url=http://www.ovirt.org/documentation/admin-guide/virt/con...
[ovirt]
host=ovirt.wanderingmad.com:443
vm-guid=8779c8b7-18e8-49ef-aff4-d84609a519a3
sso-token=fjTGwB266hsU57uyOffllkPYG2m2wnaZnQJlUswKL3bYg9YM7rOfJ3QH-aBMibqbQsCEiV7AzPn39AWz40p_SA
admin=1
should I replace certs on the host?
10:39 p.m.
I Also get these errors in the websocket proxy, it looks like either I messed up a cert on
the main ovirt machine, or there is some additiona configuration on the hosts.
May 06 22:33:07 ovirt.domain.com ovirt-websocket[31306]: 2019-05-06 22:33:07,786-0400
ovirt-websocket-proxy: INFO log_message:117 <client> - - [06/May/2019 22:33:07]
connecting to: <ovirt_node>:5900 (using SSL)
May 06 22:33:07 ovirt.wanderingmad.com ovirt-websocket-proxy.py[30731]:
ovirt-websocket-proxy[31306] INFO log_message:117 <client> - - [06/May/2019
22:33:07] connecting to: <ovirt-node>:5900 (using SSL)
May 06 22:33:07 ovirt.domain.com ovirt-websocket-proxy.py[30731]:
ovirt-websocket-proxy[31306] INFO msg:887 handler exception: [Errno -2] Name or service
not known
2056
days inactive
2060
days old
5 comments
2 participants
participants (2)
-
michael＠wanderingmad.com -
Yedidyah Bar David