Public bug reported: If the nova-api-metadata service is secured with a certificate that makes use of IP based SAN's, under Python 2 certificate validation will fail as the ssl module does not support use of IP addresses in cert SAN fields (and httplib2 which is used to make the request uses ssl directly).
Master branch of neutron has switched (see [0]) to using requests to make these calls, supporting use of certs with IP address based SAN's (via urllib3 which does support IP address based SAN's under Python 2). [0] https://github.com/openstack/neutron/commit/7e0dd2f18d4919964655cfce7a282d1c5c131fc4 ** Affects: neutron Importance: Undecided Status: Fix Committed ** Affects: neutron (Ubuntu) Importance: High Status: Triaged ** Affects: neutron (Ubuntu Xenial) Importance: High Status: Triaged ** Affects: neutron (Ubuntu Bionic) Importance: High Status: Triaged ** Affects: neutron (Ubuntu Cosmic) Importance: High Status: Triaged ** Also affects: neutron (Ubuntu Cosmic) Importance: Undecided Status: New ** Also affects: neutron (Ubuntu Bionic) Importance: Undecided Status: New ** Also affects: neutron (Ubuntu Xenial) Importance: Undecided Status: New ** Changed in: neutron (Ubuntu Cosmic) Status: New => Triaged ** Changed in: neutron (Ubuntu Bionic) Status: New => Triaged ** Changed in: neutron (Ubuntu Xenial) Status: New => Triaged ** Changed in: neutron (Ubuntu Xenial) Importance: Undecided => High ** Changed in: neutron (Ubuntu Bionic) Importance: Undecided => High ** Changed in: neutron (Ubuntu Cosmic) Importance: Undecided => High ** Description changed: If the nova-api-metadata service is secured with a certificate that makes use of IP based SAN's, under Python 2 certificate validation will fail as the ssl module does not support use of IP addresses in cert SAN fields (and httplib2 which is used to make the request uses ssl directly). - Master branch of neutron has switched to using requests (via urllib3 - which does support IP address based SAN's under Python 2) to make these - calls, supporting use of certs with IP address based SAN's. + Master branch of neutron has switched to using requests to make these + calls, supporting use of certs with IP address based SAN's (via urllib3 + which does support IP address based SAN's under Python 2). ** Description changed: If the nova-api-metadata service is secured with a certificate that makes use of IP based SAN's, under Python 2 certificate validation will fail as the ssl module does not support use of IP addresses in cert SAN fields (and httplib2 which is used to make the request uses ssl directly). - Master branch of neutron has switched to using requests to make these - calls, supporting use of certs with IP address based SAN's (via urllib3 - which does support IP address based SAN's under Python 2). + Master branch of neutron has switched (see [0]) to using requests to + make these calls, supporting use of certs with IP address based SAN's + (via urllib3 which does support IP address based SAN's under Python 2). + + [0] + https://github.com/openstack/neutron/commit/7e0dd2f18d4919964655cfce7a282d1c5c131fc4 ** Also affects: neutron Importance: Undecided Status: New ** Changed in: neutron Status: New => Fix Committed -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to neutron. https://bugs.launchpad.net/bugs/1790598 Title: metadata service calls to nova-api-metadata with IP based SAN's fails Status in neutron: Fix Committed Status in neutron package in Ubuntu: Triaged Status in neutron source package in Xenial: Triaged Status in neutron source package in Bionic: Triaged Status in neutron source package in Cosmic: Triaged Bug description: If the nova-api-metadata service is secured with a certificate that makes use of IP based SAN's, under Python 2 certificate validation will fail as the ssl module does not support use of IP addresses in cert SAN fields (and httplib2 which is used to make the request uses ssl directly). Master branch of neutron has switched (see [0]) to using requests to make these calls, supporting use of certs with IP address based SAN's (via urllib3 which does support IP address based SAN's under Python 2). [0] https://github.com/openstack/neutron/commit/7e0dd2f18d4919964655cfce7a282d1c5c131fc4 To manage notifications about this bug go to: https://bugs.launchpad.net/neutron/+bug/1790598/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : [email protected] Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp
