<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On May 22, 2015, at 9:39 PM, Tycho Andersen <<a href="mailto:tycho.andersen@canonical.com">tycho.andersen@canonical.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On Fri, May 22, 2015 at 09:32:05PM -0700, Kevin LaTona wrote:<br><blockquote type="cite"><br>On May 22, 2015, at 9:13 PM, Tycho Andersen <<a href="mailto:tycho.andersen@canonical.com">tycho.andersen@canonical.com</a>> wrote:<br><br><blockquote type="cite">On Fri, May 22, 2015 at 05:14:06PM -0700, Kevin LaTona wrote:<br><blockquote type="cite"><br>This past week or so I ran into an issue of not being able to connect a test LXD rest server on my local network.<br><br>I've tested this problem out from pretty much every angle I can think of.<br><br>Every thing from fresh OS, server, SSL lib installs to upgrades of current running apps on my machines.<br><br><br>Pretty much unless I am missing some small fundamental piece that is preventing current shipping vivid server to allow connections to the LXD rest server.<br><br>My take is there is a bug .<br><br>If this true, what is the best way to let the LXC team know about this to see how to get to next step?<br><br><br>To sum it up I am able to connect to a public LXD rest server.<br><br># from vivid container --> public LXD server ( container to public )<br>curl -k <a href="https://images.linuxcontainers.org/1.0/images">https://images.linuxcontainers.org/1.0/images</a><br># {"status": "Success", "metadata": ["/1.0/images/e7ae410ee8abeb6<br><br><br>No matter how and from what angle I try connecting to a local test LXD rest server it is having connections issues.<br><br># vivid container 10.0.3.5 --> 192.168.0.50:8443 ( container to host machine )<br># this container can ping 192.168.0.50 <br>curl -k <a href="https://192.168.0.50:8443/1.0/images">https://192.168.0.50:8443/1.0/images</a><br># curl: (35) error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate<br></blockquote><br>You probably need to pass --cert and --key to curl as well; you can<br>see examples of this in the /tests directory.<br></blockquote><br><br>I'll look into that to see if that helps.<br><br><br>Yet I am able to hit the <a href="http://images.linuxcontainers.org">images.linuxcontainers.org</a> server from all ….<br></blockquote><br>Yes, <a href="http://images.linuxcontainers.org">images.linuxcontainers.org</a> is not a real LXD server, it just<br>implements parts of the rest API (the public bits).<br></blockquote><div><br></div><div><br></div><div>There was enough of it running to help me figure out I am able to connect to a LDX server at least.</div><div><br></div><div>I know the Request Library has a helper app in it deal with all the various provider of certs to make it easier for folks to have to mess around.</div><div><br></div><div><br></div><div>But with self signed certs…….. all bets are off.</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><br><blockquote type="cite"><br><blockquote type="cite">Using OS X, Ubuntu host and from Container and all with the same Curl command calls.<br><br>Which has me wondering why that server and not my local LXD rest server?<br><br>So far makes zero sense to me and the Rest server should make things simpler in the end.<br><br><br><br>Unless I am missing something in configs or settings some where else… or there is bug. <br><br><br>I've chased enough code problems to know when you hammer on it from all possible ways.<br><br>And it's working part of the time….. some thing is off as it's just not making sense.<br><br>Plus I am not seeing any mention in LXD docs about need for cert and keys for this kind of call.<br></blockquote><br>I suppose there's no reason we couldn't allow requests without a<br>client cert to work for unauthenticated requests; I don't anticipate<br>it being a hugely common use case, though, as most people should be<br>using a client or API to access LXD.<br></blockquote><div><br></div><div><br></div><div><br></div><div><br></div><div>It was a dim light in the end of tunnel figuring out why some people must having it work and I can't so far.</div><div><br></div><div><br></div><div>Either some one is not documented something important in the publically published doc's or ?????????</div><div><br></div><div><br></div><div><br></div><br><blockquote type="cite"><br><blockquote type="cite"><br>If I need them for the local server I would need them for the pulbic server as well since Linuxcontainers is using self signed cert on that site.<br></blockquote><br><a href="http://images.linuxcontainers.org">images.linuxcontainers.org</a> shouldn't be using a self signed cert; LXD<br>does, though.<br><br></blockquote><div><br></div><div><br></div><div>This is what info the <a href="http://lc.org">lc.org</a> cert shows</div><div><br></div><div><img id="932c13fd-66f6-45ee-8be0-cde4add68ede" height="420" width="526" apple-width="yes" apple-height="yes" src="cid:60B3A8B4-FF09-40E4-B2F7-DEB4961A6939"></div><div><br></div><br><blockquote type="cite">Tycho<br><br><blockquote type="cite"><br><br>-Kevin<br><br><br><br><br><br><br><br><br><br><blockquote type="cite">Tycho<br><br><blockquote type="cite"><br><br># OS X term window --> vivid server (same 192.168.x.x network)<br>curl -k <a href="https://192.168.0.50:8443/1.0/images">https://192.168.0.50:8443/1.0/images</a><br># curl: (35) error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version<br><br><br><br>If any one has any ideas or suggestions please send them along.<br><br>-Kevin<br><br><br><br>_______________________________________________<br>lxc-users mailing list<br><a href="mailto:lxc-users@lists.linuxcontainers.org">lxc-users@lists.linuxcontainers.org</a><br>http://lists.linuxcontainers.org/listinfo/lxc-users<br></blockquote>_______________________________________________<br>lxc-users mailing list<br><a href="mailto:lxc-users@lists.linuxcontainers.org">lxc-users@lists.linuxcontainers.org</a><br>http://lists.linuxcontainers.org/listinfo/lxc-users<br></blockquote><br>_______________________________________________<br>lxc-users mailing list<br><a href="mailto:lxc-users@lists.linuxcontainers.org">lxc-users@lists.linuxcontainers.org</a><br>http://lists.linuxcontainers.org/listinfo/lxc-users<br></blockquote>_______________________________________________<br>lxc-users mailing list<br><a href="mailto:lxc-users@lists.linuxcontainers.org">lxc-users@lists.linuxcontainers.org</a><br>http://lists.linuxcontainers.org/listinfo/lxc-users</blockquote></div><br></body></html>