<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On May 23, 2015, at 12:13 AM, Janjaap Bos <<a href="mailto:janjaapbos@gmail.com">janjaapbos@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">Yes, you are a step further now that TLS is spoken. However, I would suggest to first get your test working locally on the lxd server, since my homebrew OSX curl has further restrictions. You can only use certificates that are in the keychain:<div><div>* WARNING: SSL: CURLOPT_SSLKEY is ignored by Secure Transport. The private key must be in the Keychain.</div><div>* WARNING: SSL: Certificate type not set, assuming PKCS#12 format.</div></div></div></blockquote><div><br></div><div><br></div><div>When I did all of the steps you suggested the nev version of Curl sent back</div><div><br></div><div>curl: (58) SSL: Can't load the certificate "server.crt" and its private key: OSStatus -50</div><div><br></div><div><br></div><div>I tried to import the server.crt into keychain and it choked.</div><div><br></div><div>Not sure why maybe it just didn't like how I created it or ???</div><div><br></div><div><br></div><br><blockquote type="cite"><div dir="ltr"><div><br></div><div>When trying your example on my lxd server, I do the following steps (as root user).</div><div><br></div><div># cd /root/.config/lxc</div><div># ls</div><div>client.crt client.key config.yml servercerts<br></div></div></blockquote><div><br></div><div><br></div><div>Interesting as the config.yaml and servercert where not in my folder just now.</div><div><br></div><div>I double checked my steps taken notes and do see I issued a call to lxc remote add lxc-org <a href="http://images.linuxcontainers.org/">images.linuxcontainers.org</a></div><div><br></div><div>And it did not load at the the initial call set up time.</div><div><br></div><div><br></div><div><br></div><br><blockquote type="cite"><div dir="ltr"><div><br></div><div>Now, if you don't have these files, use can get them by doing the following:</div><div># lxc remote add lxc-org <a href="http://images.linuxcontainers.org/">images.linuxcontainers.org</a><br></div></div></blockquote><div><br></div><div><br></div><div><br></div><div>I did just re call this "remote add" call </div><div><br></div><div>And this time it added all the files and not only some of them.</div><div><br></div><div><br></div><br><blockquote type="cite"><div dir="ltr"><div><br></div><div>This should also initialise the local client certificate if it does not exist.</div><div><br></div><div>Then:</div><div># lxc config trust add client.crt</div><div># lxc config trust list</div><div>This should list the fingerprint.</div><div><br></div><div>And it should work:</div><div># curl --key client.key --cert client.crt -v -k <a href="https://localhost:8443/1.0/images">https://localhost:8443/1.0/images</a></div><div><br></div><div>(do not use the -s option as it will suppress the output)</div></div></blockquote><div><br></div><div><br></div><div><br></div><div><div>/usr/local/Cellar/curl/7.42.1/bin/curl --cert server.crt --key server.key -v -k <a href="https://192.168.0.50:8443/">https://192.168.0.50:8443/</a></div><div><br></div><div>* Trying 192.168.0.50...</div><div>* Connected to 192.168.0.50 (192.168.0.50) port 8443 (#0)</div><div>* WARNING: SSL: CURLOPT_SSLKEY is ignored by Secure Transport. The private key must be in the Keychain.</div><div>* WARNING: SSL: Certificate type not set, assuming PKCS#12 format.</div><div>* SSL: Can't load the certificate "server.crt" and its private key: OSStatus -50</div><div>* Closing connection 0</div><div>curl: (58) SSL: Can't load the certificate "server.crt" and its private key: OSStatus -50</div></div><div><br></div><div><br></div><div><br></div><div>Well it's closer to working now.</div><div><br></div><div>I still need to resolve how to get the private cert into to OS X's keychain.</div><div><br></div><div><br></div><div>Hopefully if any other OS X users come along and find these notes it will help them get it working or closer to finding out how to get it all going on Macs connecting to Ubuntu 15.04 Vivid.</div><div><br></div><div><br></div><div><br></div><div>-Kevin</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><br><blockquote type="cite"><div dir="ltr"><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2015-05-23 7:53 GMT+02:00 Kevin LaTona <span dir="ltr"><<a href="mailto:lists@studiosola.com" target="_blank">lists@studiosola.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><span class=""><br><div><div>On May 22, 2015, at 10:33 PM, Kevin LaTona <<a href="mailto:lists@studiosola.com" target="_blank">lists@studiosola.com</a>> wrote:</div><br><blockquote type="cite"><blockquote type="cite" style="font-family:Helvetica;font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><p dir="ltr">Ok, but you are testing with a curl that does not support TLS. That is why you cannot connect to that particular LXD instance. Depending on the OS and distribution, other LXD instances may still support SSL.</p><div><br></div></blockquote></blockquote><br></div><div><br></div><div><br></div><div><br></div></span><div>I did a quick upgrade of curl to 7.42.1</div><div><br></div><div>Now when I try it </div><div><br></div><div>/usr/local/Cellar/curl/7.42.1/bin/curl -s --cert server.crt --key server.key -k <a href="https://192.168.0.50:8443/1.0/images" target="_blank">https://192.168.0.50:8443/1.0/images</a></div><div><br></div><div>I know I don't want to mess with Apple's install of Curl for now.</div><div><br></div><div><br></div><div>I get ………… curl: (35) SSL peer handshake failed, the server most likely requires a client certificate to connect</div><div><br></div><div>So maybe I am getting closer and some thing is off with the cert I just made.</div><div><br></div><div><br></div><div>Would be nice to know what version of LDX is running at <a href="http://linuxcontainers.org/" target="_blank">linuxcontainers.org</a> </div><div><br></div><div>It sure might help saving lots of time chasing after another avenue that in the end may or may not solve problem.</div><span class="HOEnZb"><font color="#888888"><div><br></div><div>-Kevin</div></font></span></div><br>_______________________________________________<br>
lxc-users mailing list<br>
<a href="mailto:lxc-users@lists.linuxcontainers.org">lxc-users@lists.linuxcontainers.org</a><br>
<a href="http://lists.linuxcontainers.org/listinfo/lxc-users" target="_blank">http://lists.linuxcontainers.org/listinfo/lxc-users</a><br></blockquote></div><br></div>
_______________________________________________<br>lxc-users mailing list<br><a href="mailto:lxc-users@lists.linuxcontainers.org">lxc-users@lists.linuxcontainers.org</a><br>http://lists.linuxcontainers.org/listinfo/lxc-users</blockquote></div><br></body></html>