You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cloudstack.apache.org by Michael Phillips <mp...@hotmail.com> on 2014/05/08 04:13:32 UTC
Intermediate CA
All,
Is it still necessary to follow this guide http://www.chipchilders.com/blog/2013/1/2/undocumented-feature-using-certificate-chains-in-cloudstack.html to import an SSL cert with an intermediate cert or can it be done direct via the GUI?
Re: Intermediate CA
Posted by David Bierce <da...@appcore.com>.
Some URL encoders replace a space with a +, but it should be %20
On May 14, 2014, at 5:38 PM, Michael Phillips <mp...@hotmail.com> wrote:
> One thing I just noticed is that when URL encoding the "+" character is interpreted as a "space". So now the intermediate is filled with spaces where there were "+" signs. Any idea how to escape the "+" and have it interpret it literally?
>
>> Subject: Re: Intermediate CA
>> From: david.bierce@appcore.com
>> Date: Tue, 13 May 2014 07:34:46 -0500
>> To: users@cloudstack.apache.org
>>
>> Looks a little akward in the email, but all of it goes into a single URL encoded like. %20 for space, %0D for line breaks.
>>
>> On May 13, 2014, at 12:27 AM, Michael Phillips <mp...@hotmail.com> wrote:
>>
>>> David, excellent example.
>>> So all you needed to do was to replace the spaces in the cert with "%20", and do nothing for the line breaks?
>>>
>>>> From: david.bierce@appcore.com
>>>> Subject: Re: Intermediate CA
>>>> Date: Mon, 12 May 2014 12:18:39 -0500
>>>> To: users@cloudstack.apache.org
>>>>
>>>> There is still no way to do it in the GUI. That method works well. Or you can do it in cloud monkey like this.
>>>>
>>>> http://permalink.gmane.org/gmane.comp.apache.cloudstack.user/11711
>>>>
>>>>
>>>> On May 7, 2014, at 9:13 PM, Michael Phillips <mp...@hotmail.com> wrote:
>>>>
>>>>> All,
>>>>> Is it still necessary to follow this guide http://www.chipchilders.com/blog/2013/1/2/undocumented-feature-using-certificate-chains-in-cloudstack.html to import an SSL cert with an intermediate cert or can it be done direct via the GUI?
>>>>
>>>
>>
>
RE: Intermediate CA
Posted by Michael Phillips <mp...@hotmail.com>.
One thing I just noticed is that when URL encoding the "+" character is interpreted as a "space". So now the intermediate is filled with spaces where there were "+" signs. Any idea how to escape the "+" and have it interpret it literally?
> Subject: Re: Intermediate CA
> From: david.bierce@appcore.com
> Date: Tue, 13 May 2014 07:34:46 -0500
> To: users@cloudstack.apache.org
>
> Looks a little akward in the email, but all of it goes into a single URL encoded like. %20 for space, %0D for line breaks.
>
> On May 13, 2014, at 12:27 AM, Michael Phillips <mp...@hotmail.com> wrote:
>
> > David, excellent example.
> > So all you needed to do was to replace the spaces in the cert with "%20", and do nothing for the line breaks?
> >
> >> From: david.bierce@appcore.com
> >> Subject: Re: Intermediate CA
> >> Date: Mon, 12 May 2014 12:18:39 -0500
> >> To: users@cloudstack.apache.org
> >>
> >> There is still no way to do it in the GUI. That method works well. Or you can do it in cloud monkey like this.
> >>
> >> http://permalink.gmane.org/gmane.comp.apache.cloudstack.user/11711
> >>
> >>
> >> On May 7, 2014, at 9:13 PM, Michael Phillips <mp...@hotmail.com> wrote:
> >>
> >>> All,
> >>> Is it still necessary to follow this guide http://www.chipchilders.com/blog/2013/1/2/undocumented-feature-using-certificate-chains-in-cloudstack.html to import an SSL cert with an intermediate cert or can it be done direct via the GUI?
> >>
> >
>
RE: Primary NFS storage stuck in Maint. Mode
Posted by Curtis old <cu...@gmail.com>.
Will do once I get back onsite
From: Andrija Panic [mailto:andrija.panic@gmail.com]
Sent: Saturday, May 17, 2014 8:25 AM
To: users@cloudstack.apache.org
Cc: Curtis old
Subject: Re: Primary NFS storage stuck in Maint. Mode
there should be button to cancel maintaince mode for Primary Storage - there is NO "maintance" or "cancel maintance" button for secondary storage, at least in CS 4.2.1...
Can you provide screen shot of sec.stor. ?
On 17 May 2014 13:19, Curtis old <cu...@gmail.com> wrote:
Nobody??? Should I go in to the DB and flip it to up? How would I do that?
-----Original Message-----
From: Curtis old [mailto:curtis.old@gmail.com]
Sent: Friday, May 16, 2014 10:54 AM
To: 'users@cloudstack.apache.org'
Subject: Primary NFS storage stuck in Maint. Mode
Guys I had a power outage in my lab. I'm using an Openfiler for NFS
storage and when the Openfiler came back online I had to run an "fsck" on
the Openfiler filesystem that hosts the primary storage for my CS 4.0 With
everything down but the management node I can't get it out of maintenance
mode. Any suggestions to get it useable?
--
Andrija Panić
--------------------------------------
http://admintweets.com
--------------------------------------
Re: Primary NFS storage stuck in Maint. Mode
Posted by Andrija Panic <an...@gmail.com>.
there should be button to cancel maintaince mode for Primary Storage -
there is NO "maintance" or "cancel maintance" button for secondary storage,
at least in CS 4.2.1...
Can you provide screen shot of sec.stor. ?
On 17 May 2014 13:19, Curtis old <cu...@gmail.com> wrote:
> Nobody??? Should I go in to the DB and flip it to up? How would I do
> that?
>
> -----Original Message-----
> From: Curtis old [mailto:curtis.old@gmail.com]
> Sent: Friday, May 16, 2014 10:54 AM
> To: 'users@cloudstack.apache.org'
> Subject: Primary NFS storage stuck in Maint. Mode
>
> Guys I had a power outage in my lab. I'm using an Openfiler for NFS
> storage and when the Openfiler came back online I had to run an "fsck" on
> the Openfiler filesystem that hosts the primary storage for my CS 4.0 With
> everything down but the management node I can't get it out of maintenance
> mode. Any suggestions to get it useable?
>
>
--
Andrija Panić
--------------------------------------
http://admintweets.com
--------------------------------------
RE: Primary NFS storage stuck in Maint. Mode
Posted by Curtis old <cu...@gmail.com>.
Nobody??? Should I go in to the DB and flip it to up? How would I do that?
-----Original Message-----
From: Curtis old [mailto:curtis.old@gmail.com]
Sent: Friday, May 16, 2014 10:54 AM
To: 'users@cloudstack.apache.org'
Subject: Primary NFS storage stuck in Maint. Mode
Guys I had a power outage in my lab. I'm using an Openfiler for NFS
storage and when the Openfiler came back online I had to run an "fsck" on
the Openfiler filesystem that hosts the primary storage for my CS 4.0 With
everything down but the management node I can't get it out of maintenance
mode. Any suggestions to get it useable?
Primary NFS storage stuck in Maint. Mode
Posted by Curtis old <cu...@gmail.com>.
Guys I had a power outage in my lab. I'm using an Openfiler for NFS
storage and when the Openfiler came back online I had to run an "fsck" on
the Openfiler filesystem that hosts the primary storage for my CS 4.0 With
everything down but the management node I can't get it out of maintenance
mode. Any suggestions to get it useable?
Re: Intermediate CA
Posted by David Bierce <da...@appcore.com>.
As long as the entry in the database contains real line breaking you should be fine. I’m not sure when the process to generate the keystore outside of the API is triggered, but it will very obviously bomb if it has troubles with the key.
If you upload the cert again with the encoded line breaks but the same name and domain suffix it should trample over the DB entry and rebuild the keystore.
On May 14, 2014, at 9:17 AM, Michael Phillips <mp...@hotmail.com> wrote:
> So I did not include the "%0D", but went back and added the line breaks in the database manually. You think that's enough or do I need to delete and re-upload with the %0D?
>
>> Subject: Re: Intermediate CA
>> From: david.bierce@appcore.com
>> Date: Tue, 13 May 2014 07:34:46 -0500
>> To: users@cloudstack.apache.org
>>
>> Looks a little akward in the email, but all of it goes into a single URL encoded like. %20 for space, %0D for line breaks.
>>
>> On May 13, 2014, at 12:27 AM, Michael Phillips <mp...@hotmail.com> wrote:
>>
>>> David, excellent example.
>>> So all you needed to do was to replace the spaces in the cert with "%20", and do nothing for the line breaks?
>>>
>>>> From: david.bierce@appcore.com
>>>> Subject: Re: Intermediate CA
>>>> Date: Mon, 12 May 2014 12:18:39 -0500
>>>> To: users@cloudstack.apache.org
>>>>
>>>> There is still no way to do it in the GUI. That method works well. Or you can do it in cloud monkey like this.
>>>>
>>>> http://permalink.gmane.org/gmane.comp.apache.cloudstack.user/11711
>>>>
>>>>
>>>> On May 7, 2014, at 9:13 PM, Michael Phillips <mp...@hotmail.com> wrote:
>>>>
>>>>> All,
>>>>> Is it still necessary to follow this guide http://www.chipchilders.com/blog/2013/1/2/undocumented-feature-using-certificate-chains-in-cloudstack.html to import an SSL cert with an intermediate cert or can it be done direct via the GUI?
>>>>
>>>
>>
>
Re: Intermediate CA
Posted by Amogh Vasekar <am...@citrix.com>.
Agreed, there is a bug logged for this for UI enhancement to allow
importing chains :-) Would be great if someone can pick it up.
Thanks,
Amogh
On 5/16/14 8:48 AM, "David Bierce" <da...@appcore.com> wrote:
>It is kind of crazy that it worked without a double encode, but trying to
>manually import with line breaks are literally imported into the
>database, which is also incorrect. Because of the shell input for
>cloudmonkey import a file or copy and paste between terminals.
>
>Developers and DevOps are fine with mucking with escapes, doing Database
>Inserts, formulating API calls, but if I have to tell an administrator
>anything other than ³Go to this page in the web interface, put your in
>your certificates² it is broken.
>
>
>On May 15, 2014, at 12:50 PM, Amogh Vasekar <am...@citrix.com>
>wrote:
>
>> Hi,
>>
>> On a different note - while using cloudmonkey with URL encoded
>> certificates has worked till now, it may not future releases. The reason
>> being - there was a bug which encoded and decoded the parameters to the
>> relevant upload certificate API *twice*, and has been fixed. The double
>> decoding allowed cloudmonkey with URL encoded certificates to work. Just
>> wanted to make sure anyone referring to this thread sometime in future
>> knows that the process may not work post 4.3 :-)
>>
>> If the database has the right certificates with line breaks etc - you
>> should be fine. The code recreates the chain from the DB entries. As a
>> sanity check, a simple diff should do it.
>>
>> Thanks,
>> Amogh
>>
>> On 5/14/14 7:17 AM, "Michael Phillips" <mp...@hotmail.com> wrote:
>>
>>> So I did not include the "%0D", but went back and added the line breaks
>>> in the database manually. You think that's enough or do I need to
>>>delete
>>> and re-upload with the %0D?
>>>
>>>> Subject: Re: Intermediate CA
>>>> From: david.bierce@appcore.com
>>>> Date: Tue, 13 May 2014 07:34:46 -0500
>>>> To: users@cloudstack.apache.org
>>>>
>>>> Looks a little akward in the email, but all of it goes into a single
>>>> URL encoded like. %20 for space, %0D for line breaks.
>>>>
>>>> On May 13, 2014, at 12:27 AM, Michael Phillips
>>>> <mp...@hotmail.com> wrote:
>>>>
>>>>> David, excellent example.
>>>>> So all you needed to do was to replace the spaces in the cert with
>>>> "%20", and do nothing for the line breaks?
>>>>>
>>>>>> From: david.bierce@appcore.com
>>>>>> Subject: Re: Intermediate CA
>>>>>> Date: Mon, 12 May 2014 12:18:39 -0500
>>>>>> To: users@cloudstack.apache.org
>>>>>>
>>>>>> There is still no way to do it in the GUI. That method works well.
>>>> Or you can do it in cloud monkey like this.
>>>>>>
>>>>>> http://permalink.gmane.org/gmane.comp.apache.cloudstack.user/11711
>>>>>>
>>>>>>
>>>>>> On May 7, 2014, at 9:13 PM, Michael Phillips
>>>> <mp...@hotmail.com> wrote:
>>>>>>
>>>>>>> All,
>>>>>>> Is it still necessary to follow this guide
>>>>
>>>>http://www.chipchilders.com/blog/2013/1/2/undocumented-feature-using-ce
>>>>rt
>>>> ificate-chains-in-cloudstack.html to import an SSL cert with an
>>>> intermediate cert or can it be done direct via the GUI?
>>>>>>
>>>>>
>>>>
>>>
>>
>
Re: Intermediate CA
Posted by David Bierce <da...@appcore.com>.
It is kind of crazy that it worked without a double encode, but trying to manually import with line breaks are literally imported into the database, which is also incorrect. Because of the shell input for cloudmonkey import a file or copy and paste between terminals.
Developers and DevOps are fine with mucking with escapes, doing Database Inserts, formulating API calls, but if I have to tell an administrator anything other than “Go to this page in the web interface, put your in your certificates” it is broken.
On May 15, 2014, at 12:50 PM, Amogh Vasekar <am...@citrix.com> wrote:
> Hi,
>
> On a different note - while using cloudmonkey with URL encoded
> certificates has worked till now, it may not future releases. The reason
> being - there was a bug which encoded and decoded the parameters to the
> relevant upload certificate API *twice*, and has been fixed. The double
> decoding allowed cloudmonkey with URL encoded certificates to work. Just
> wanted to make sure anyone referring to this thread sometime in future
> knows that the process may not work post 4.3 :-)
>
> If the database has the right certificates with line breaks etc - you
> should be fine. The code recreates the chain from the DB entries. As a
> sanity check, a simple diff should do it.
>
> Thanks,
> Amogh
>
> On 5/14/14 7:17 AM, "Michael Phillips" <mp...@hotmail.com> wrote:
>
>> So I did not include the "%0D", but went back and added the line breaks
>> in the database manually. You think that's enough or do I need to delete
>> and re-upload with the %0D?
>>
>>> Subject: Re: Intermediate CA
>>> From: david.bierce@appcore.com
>>> Date: Tue, 13 May 2014 07:34:46 -0500
>>> To: users@cloudstack.apache.org
>>>
>>> Looks a little akward in the email, but all of it goes into a single
>>> URL encoded like. %20 for space, %0D for line breaks.
>>>
>>> On May 13, 2014, at 12:27 AM, Michael Phillips
>>> <mp...@hotmail.com> wrote:
>>>
>>>> David, excellent example.
>>>> So all you needed to do was to replace the spaces in the cert with
>>> "%20", and do nothing for the line breaks?
>>>>
>>>>> From: david.bierce@appcore.com
>>>>> Subject: Re: Intermediate CA
>>>>> Date: Mon, 12 May 2014 12:18:39 -0500
>>>>> To: users@cloudstack.apache.org
>>>>>
>>>>> There is still no way to do it in the GUI. That method works well.
>>> Or you can do it in cloud monkey like this.
>>>>>
>>>>> http://permalink.gmane.org/gmane.comp.apache.cloudstack.user/11711
>>>>>
>>>>>
>>>>> On May 7, 2014, at 9:13 PM, Michael Phillips
>>> <mp...@hotmail.com> wrote:
>>>>>
>>>>>> All,
>>>>>> Is it still necessary to follow this guide
>>> http://www.chipchilders.com/blog/2013/1/2/undocumented-feature-using-cert
>>> ificate-chains-in-cloudstack.html to import an SSL cert with an
>>> intermediate cert or can it be done direct via the GUI?
>>>>>
>>>>
>>>
>>
>
Re: Intermediate CA
Posted by Amogh Vasekar <am...@citrix.com>.
Hi,
On a different note - while using cloudmonkey with URL encoded
certificates has worked till now, it may not future releases. The reason
being - there was a bug which encoded and decoded the parameters to the
relevant upload certificate API *twice*, and has been fixed. The double
decoding allowed cloudmonkey with URL encoded certificates to work. Just
wanted to make sure anyone referring to this thread sometime in future
knows that the process may not work post 4.3 :-)
If the database has the right certificates with line breaks etc - you
should be fine. The code recreates the chain from the DB entries. As a
sanity check, a simple diff should do it.
Thanks,
Amogh
On 5/14/14 7:17 AM, "Michael Phillips" <mp...@hotmail.com> wrote:
>So I did not include the "%0D", but went back and added the line breaks
>in the database manually. You think that's enough or do I need to delete
>and re-upload with the %0D?
>
>> Subject: Re: Intermediate CA
>> From: david.bierce@appcore.com
>> Date: Tue, 13 May 2014 07:34:46 -0500
>> To: users@cloudstack.apache.org
>>
>> Looks a little akward in the email, but all of it goes into a single
>>URL encoded like. %20 for space, %0D for line breaks.
>>
>> On May 13, 2014, at 12:27 AM, Michael Phillips
>><mp...@hotmail.com> wrote:
>>
>> > David, excellent example.
>> > So all you needed to do was to replace the spaces in the cert with
>>"%20", and do nothing for the line breaks?
>> >
>> >> From: david.bierce@appcore.com
>> >> Subject: Re: Intermediate CA
>> >> Date: Mon, 12 May 2014 12:18:39 -0500
>> >> To: users@cloudstack.apache.org
>> >>
>> >> There is still no way to do it in the GUI. That method works well.
>>Or you can do it in cloud monkey like this.
>> >>
>> >> http://permalink.gmane.org/gmane.comp.apache.cloudstack.user/11711
>> >>
>> >>
>> >> On May 7, 2014, at 9:13 PM, Michael Phillips
>><mp...@hotmail.com> wrote:
>> >>
>> >>> All,
>> >>> Is it still necessary to follow this guide
>>http://www.chipchilders.com/blog/2013/1/2/undocumented-feature-using-cert
>>ificate-chains-in-cloudstack.html to import an SSL cert with an
>>intermediate cert or can it be done direct via the GUI?
>> >>
>> >
>>
>
RE: Intermediate CA
Posted by Michael Phillips <mp...@hotmail.com>.
So I did not include the "%0D", but went back and added the line breaks in the database manually. You think that's enough or do I need to delete and re-upload with the %0D?
> Subject: Re: Intermediate CA
> From: david.bierce@appcore.com
> Date: Tue, 13 May 2014 07:34:46 -0500
> To: users@cloudstack.apache.org
>
> Looks a little akward in the email, but all of it goes into a single URL encoded like. %20 for space, %0D for line breaks.
>
> On May 13, 2014, at 12:27 AM, Michael Phillips <mp...@hotmail.com> wrote:
>
> > David, excellent example.
> > So all you needed to do was to replace the spaces in the cert with "%20", and do nothing for the line breaks?
> >
> >> From: david.bierce@appcore.com
> >> Subject: Re: Intermediate CA
> >> Date: Mon, 12 May 2014 12:18:39 -0500
> >> To: users@cloudstack.apache.org
> >>
> >> There is still no way to do it in the GUI. That method works well. Or you can do it in cloud monkey like this.
> >>
> >> http://permalink.gmane.org/gmane.comp.apache.cloudstack.user/11711
> >>
> >>
> >> On May 7, 2014, at 9:13 PM, Michael Phillips <mp...@hotmail.com> wrote:
> >>
> >>> All,
> >>> Is it still necessary to follow this guide http://www.chipchilders.com/blog/2013/1/2/undocumented-feature-using-certificate-chains-in-cloudstack.html to import an SSL cert with an intermediate cert or can it be done direct via the GUI?
> >>
> >
>
Re: Intermediate CA
Posted by David Bierce <da...@appcore.com>.
Looks a little akward in the email, but all of it goes into a single URL encoded like. %20 for space, %0D for line breaks.
On May 13, 2014, at 12:27 AM, Michael Phillips <mp...@hotmail.com> wrote:
> David, excellent example.
> So all you needed to do was to replace the spaces in the cert with "%20", and do nothing for the line breaks?
>
>> From: david.bierce@appcore.com
>> Subject: Re: Intermediate CA
>> Date: Mon, 12 May 2014 12:18:39 -0500
>> To: users@cloudstack.apache.org
>>
>> There is still no way to do it in the GUI. That method works well. Or you can do it in cloud monkey like this.
>>
>> http://permalink.gmane.org/gmane.comp.apache.cloudstack.user/11711
>>
>>
>> On May 7, 2014, at 9:13 PM, Michael Phillips <mp...@hotmail.com> wrote:
>>
>>> All,
>>> Is it still necessary to follow this guide http://www.chipchilders.com/blog/2013/1/2/undocumented-feature-using-certificate-chains-in-cloudstack.html to import an SSL cert with an intermediate cert or can it be done direct via the GUI?
>>
>
RE: Intermediate CA
Posted by Michael Phillips <mp...@hotmail.com>.
David, excellent example.
So all you needed to do was to replace the spaces in the cert with "%20", and do nothing for the line breaks?
> From: david.bierce@appcore.com
> Subject: Re: Intermediate CA
> Date: Mon, 12 May 2014 12:18:39 -0500
> To: users@cloudstack.apache.org
>
> There is still no way to do it in the GUI. That method works well. Or you can do it in cloud monkey like this.
>
> http://permalink.gmane.org/gmane.comp.apache.cloudstack.user/11711
>
>
> On May 7, 2014, at 9:13 PM, Michael Phillips <mp...@hotmail.com> wrote:
>
> > All,
> > Is it still necessary to follow this guide http://www.chipchilders.com/blog/2013/1/2/undocumented-feature-using-certificate-chains-in-cloudstack.html to import an SSL cert with an intermediate cert or can it be done direct via the GUI?
>
Re: Intermediate CA
Posted by David Bierce <da...@appcore.com>.
There is still no way to do it in the GUI. That method works well. Or you can do it in cloud monkey like this.
http://permalink.gmane.org/gmane.comp.apache.cloudstack.user/11711
On May 7, 2014, at 9:13 PM, Michael Phillips <mp...@hotmail.com> wrote:
> All,
> Is it still necessary to follow this guide http://www.chipchilders.com/blog/2013/1/2/undocumented-feature-using-certificate-chains-in-cloudstack.html to import an SSL cert with an intermediate cert or can it be done direct via the GUI?