How can I regenerate the ovirt engine CA certs and corresponding vdsm
certs?  I have an ovirt setup that I'm upgrading from 3.2.0 (from the dre
repos) to 3.2.3 and I am getting the certificate errors listed below after
the upgrade.  I have done this same upgrade on an number of other
ovirt-engines with no issue.  The setup had originally been installed with
ovirt 3.1 so it possible that some of the certificate configurations from
3.1 are still present on this ovirt-engine and it is contributing to the
problem.  For example, I noticed that the /etc/pki/ovirt-engine/cacert.conf
file on this troublesome upgrade has "default_bits = rsa:1024", but the
systems that upgraded successfully have "default_bits = rsa:2048".  The
same is true for the cert.conf file.


2014-03-10 17:10:28,954 ERROR
(DefaultQuartzScheduler_Worker-2) vds::refreshVdsStats Failed getVdsStats,
vds = a7459d21-b5a6-4330-9897-f2018c9a1776 : vm1, error =
VDSNetworkException: Received fatal
alert: bad_certificate


20:58:00,871::SecureXMLRPCServer::97::root::(verify) invalid client
certificate with subject "/C=US/

20:58:00,872::BindingXMLRPC::72::vds::(threaded_start) xml-rpc handler

Traceback (most recent call last):

  File "/usr/share/vdsm/", line 68, in threaded_start


  File "/usr/lib64/python2.6/", line 268, in handle_request


  File "/usr/lib64/python2.6/", line 278, in

    request, client_address = self.get_request()

  File "/usr/lib64/python2.6/", line 446, in get_request

    return self.socket.accept()

  File "/usr/lib64/python2.6/site-packages/vdsm/",
line 116, in accept

    client, address = self.connection.accept()

  File "/usr/lib64/python2.6/site-packages/M2Crypto/SSL/",
line 167, in accept


  File "/usr/lib64/python2.6/site-packages/M2Crypto/SSL/",
line 156, in accept_ssl

    return m2.ssl_accept(self.ssl, self._timeout)

SSLError: no certificate returned
Users mailing list

Reply via email to