{"action":"opened","issue":{"url":"https://api.github.com/repos/rancher/rancher/issues/1980","labels_url":"https://api.github.com/repos/rancher/rancher/issues/1980/labels{/name}","comments_url":"https://api.github.com/repos/rancher/rancher/issues/1980/comments","events_url":"https://api.github.com/repos/rancher/rancher/issues/1980/events","html_url":"https://github.com/rancher/rancher/issues/1980","id":104972626,"number":1980,"title":"LB rules are not functional when dsa private keys are used.","user":{"login":"sangeethah","id":4266958,"avatar_url":"https://avatars.githubusercontent.com/u/4266958?v=3","gravatar_id":"","url":"https://api.github.com/users/sangeethah","html_url":"https://github.com/sangeethah","followers_url":"https://api.github.com/users/sangeethah/followers","following_url":"https://api.github.com/users/sangeethah/following{/other_user}","gists_url":"https://api.github.com/users/sangeethah/gists{/gist_id}","starred_url":"https://api.github.com/users/sangeethah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sangeethah/subscriptions","organizations_url":"https://api.github.com/users/sangeethah/orgs","repos_url":"https://api.github.com/users/sangeethah/repos","events_url":"https://api.github.com/users/sangeethah/events{/privacy}","received_events_url":"https://api.github.com/users/sangeethah/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rancher/rancher/labels/kind/bug","name":"kind/bug","color":"fc2929"}],"state":"open","locked":false,"assignee":{"login":"alena1108","id":1562176,"avatar_url":"https://avatars.githubusercontent.com/u/1562176?v=3","gravatar_id":"","url":"https://api.github.com/users/alena1108","html_url":"https://github.com/alena1108","followers_url":"https://api.github.com/users/alena1108/followers","following_url":"https://api.github.com/users/alena1108/following{/other_user}","gists_url":"https://api.github.com/users/alena1108/gists{/gist_id}","starred_url":"https://api.github.com/users/alena1108/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alena1108/subscriptions","organizations_url":"https://api.github.com/users/alena1108/orgs","repos_url":"https://api.github.com/users/alena1108/repos","events_url":"https://api.github.com/users/alena1108/events{/privacy}","received_events_url":"https://api.github.com/users/alena1108/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/rancher/rancher/milestones/37","html_url":"https://github.com/rancher/rancher/milestones/Milestone%209/2/2015","labels_url":"https://api.github.com/repos/rancher/rancher/milestones/37/labels","id":1274329,"number":37,"title":"Milestone 9/2/2015","description":"0.36","creator":{"login":"will-chan","id":10134676,"avatar_url":"https://avatars.githubusercontent.com/u/10134676?v=3","gravatar_id":"","url":"https://api.github.com/users/will-chan","html_url":"https://github.com/will-chan","followers_url":"https://api.github.com/users/will-chan/followers","following_url":"https://api.github.com/users/will-chan/following{/other_user}","gists_url":"https://api.github.com/users/will-chan/gists{/gist_id}","starred_url":"https://api.github.com/users/will-chan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/will-chan/subscriptions","organizations_url":"https://api.github.com/users/will-chan/orgs","repos_url":"https://api.github.com/users/will-chan/repos","events_url":"https://api.github.com/users/will-chan/events{/privacy}","received_events_url":"https://api.github.com/users/will-chan/received_events","type":"User","site_admin":false},"open_issues":29,"closed_issues":6,"state":"open","created_at":"2015-08-26T21:25:55Z","updated_at":"2015-09-04T21:24:44Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2015-09-04T21:24:44Z","updated_at":"2015-09-04T21:24:44Z","closed_at":null,"body":"Server Version - Built from master\r\n\r\nCreated LB rules with ssl enabled listeners with default cert having the dsa private keys and certificates.\r\n\r\nLB rules are not functional.\r\n\r\nFollowing exception is seen repeatedly in the logs where haproxy is not being updates successfully:\r\n\r\n```\r\n2015-09-04 21:04:38,163 ERROR [:] [] [] [] [utorService-468] [.p.c.v.i.ConfigItemStatusManagerImpl] Failed null, exit code [1] output [INFO: Updating haproxy\r\nINFO: Downloading http://23.251.144.8:8080/v1//configcontent//haproxy current=haproxy-1-c9c77ebbc9c9f2e9c3a5024f797753c493a053da5b9ef116ef412bd51c94a07f\r\nINFO: Running /var/lib/cattle/download/haproxy/haproxy-5-c9c77ebbc9c9f2e9c3a5024f797753c493a053da5b9ef116ef412bd51c94a07f/apply.sh\r\nINFO: ROOT -> ./\r\nINFO: ROOT -> ./etc/\r\nINFO: ROOT -> ./etc/default/\r\nINFO: ROOT -> ./etc/default/haproxy\r\nINFO: ROOT -> ./etc/haproxy/\r\nINFO: ROOT -> ./etc/haproxy/haproxy.cfg\r\nINFO: ROOT -> ./etc/haproxy/certs/\r\nINFO: ROOT -> ./etc/haproxy/certs/default.pem\r\nINFO: ROOT -> ./etc/haproxy/certs/certs.pem\r\nINFO: ROOT -> ./etc/monit/\r\nINFO: ROOT -> ./etc/monit/conf.d/\r\nINFO: ROOT -> ./etc/monit/conf.d/haproxy\r\nINFO: Reloading monit\r\n[ALERT] 246/210438 (31296) : parsing [/etc/haproxy/haproxy.cfg:33] : 'bind 10.42.182.172:9798' : \r\n  unable to load SSL certificate from PEM file '/etc/haproxy/certs/server.pem'.\r\n  unable to load SSL certificate from PEM file '/etc/haproxy/certs/default.pem'.\r\n[ALERT] 246/210438 (31296) : parsing [/etc/haproxy/haproxy.cfg:48] : 'bind 10.42.182.172:9797' : \r\n  unable to load SSL certificate from PEM file '/etc/haproxy/certs/server.pem'.\r\n  unable to load SSL certificate from PEM file '/etc/haproxy/certs/default.pem'.\r\n[ALERT] 246/210438 (31296) : Error(s) found in configuration file : /etc/haproxy/haproxy.cfg\r\n[ALERT] 246/210438 (31296) : Proxy 'b4271e5f-3d9c-4256-abfa-1cf1b3578a5b_frontend': no SSL certificate specified for bind '10.42.182.172:9798' at [/etc/haproxy/haproxy.cfg:33] (use 'crt').\r\n[ALERT] 246/210438 (31296) : Proxy '6e156340-4375-4e89-800d-7a33601127c8_frontend': no SSL certificate specified for bind '10.42.182.172:9797' at [/etc/haproxy/haproxy.cfg:48] (use 'crt').\r\n[ALERT] 246/210438 (31296) : Fatal errors found in configuration.\r\n[[scripts.sh:198] docker_env\r\n[[scripts.sh:26] '[' -e /.dockerenv ']'\r\n[[[scripts.sh:27] docker_env_vars\r\n[[[scripts.sh:19] '[' -e /.dockerenv ']'\r\n[[[scripts.sh:20] grep CATTLE_\r\n[[[scripts.sh:20] xargs -0 '-I{}' echo export '\"{}\"'\r\n[[[scripts.sh:20] cat /proc/1/environ\r\n[[scripts.sh:27] eval export '\"CATTLE_CONFIG_URL=http://23.251.144.8:8080/v1\"' export '\"CATTLE_AGENT_INSTANCE_AUTH=Basic' 'NDQzNjE2MzcxODQ4Q0Q4NzE2MUY6YXhQQjc0b0hmUUxKTGhENHpDNGd4Q0ZodFltVW8zWEhXS2Q5MkxnUA==\"' export '\"CATTLE_HOME=/var/lib/cattle\"'\r\n[[[scripts.sh:27] export CATTLE_CONFIG_URL=http://23.251.144.8:8080/v1 export 'CATTLE_AGENT_INSTANCE_AUTH=Basic NDQzNjE2MzcxODQ4Q0Q4NzE2MUY6YXhQQjc0b0hmUUxKTGhENHpDNGd4Q0ZodFltVW8zWEhXS2Q5MkxnUA==' export CATTLE_HOME=/var/lib/cattle\r\n[[[scripts.sh:27] CATTLE_CONFIG_URL=http://23.251.144.8:8080/v1\r\n[[[scripts.sh:27] CATTLE_AGENT_INSTANCE_AUTH='Basic NDQzNjE2MzcxODQ4Q0Q4NzE2MUY6YXhQQjc0b0hmUUxKTGhENHpDNGd4Q0ZodFltVW8zWEhXS2Q5MkxnUA=='\r\n[[[scripts.sh:27] CATTLE_HOME=/var/lib/cattle\r\n[[scripts.sh:199] script_env\r\n[[scripts.sh:123] '[' -n http://23.251.144.8:8080/v1 ']'\r\n[[scripts.sh:124] return\r\n[[scripts.sh:201] export CATTLE_HOME=/var/lib/cattle\r\n[[scripts.sh:201] CATTLE_HOME=/var/lib/cattle\r\n[[scripts.sh:202] export CATTLE_CONFIG_URL=http://23.251.144.8:8080/v1\r\n[[scripts.sh:202] CATTLE_CONFIG_URL=http://23.251.144.8:8080/v1\r\n[[scripts.sh:203] export CATTLE_STORAGE_URL=\r\n[[scripts.sh:203] CATTLE_STORAGE_URL=\r\n[apply.sh:5] rm -rf /etc/haproxy/certs/default.pem /etc/haproxy/certs/server.pem\r\n[apply.sh:6] stage_files\r\n[scripts.sh:91] local monit=false\r\n[scripts.sh:93] '[' -d content-home ']'\r\n[scripts.sh:98] '[' -d content ']'\r\n[scripts.sh:99] for i in 'content/etc/init.d/*'\r\n[scripts.sh:100] '[' -f 'content/etc/init.d/*' ']'\r\n[scripts.sh:105] for i in 'content/etc/monit/conf.d/*'\r\n[scripts.sh:106] '[' -f content/etc/monit/conf.d/haproxy ']'\r\n[scripts.sh:107] monit=true\r\n[scripts.sh:108] chmod 600 content/etc/monit/conf.d/haproxy\r\n[scripts.sh:112] find content -name '*.sh' -exec chmod +x '{}' ';'\r\n[scripts.sh:113] sed 's/^/INFO: ROOT -> /'\r\n[scripts.sh:113] tar xvf - --no-overwrite-dir -C /\r\n[scripts.sh:113] tar cf - -C content .\r\nINFO: ROOT -> ./\r\nINFO: ROOT -> ./etc/\r\nINFO: ROOT -> ./etc/default/\r\nINFO: ROOT -> ./etc/default/haproxy\r\nINFO: ROOT -> ./etc/haproxy/\r\nINFO: ROOT -> ./etc/haproxy/haproxy.cfg\r\nINFO: ROOT -> ./etc/haproxy/certs/\r\nINFO: ROOT -> ./etc/haproxy/certs/default.pem\r\nINFO: ROOT -> ./etc/haproxy/certs/certs.pem\r\nINFO: ROOT -> ./etc/monit/\r\nINFO: ROOT -> ./etc/monit/conf.d/\r\nINFO: ROOT -> ./etc/monit/conf.d/haproxy\r\n[scripts.sh:116] '[' true = true ']'\r\n[scripts.sh:117] reload_monit\r\n[[scripts.sh:82] pidof monit\r\n[scripts.sh:82] local monit=448\r\n[scripts.sh:83] '[' -n 448 ']'\r\n[scripts.sh:84] info Reloading monit\r\n[scripts.sh:33] echo INFO: Reloading monit\r\nINFO: Reloading monit\r\n[scripts.sh:85] kill -HUP 448\r\n[apply.sh:8] awk '/BEGIN RSA PRIVATE KEY/{i++}{print > \"/etc/haproxy/certs/server\"i\".pem\"}' /etc/haproxy/certs/certs.pem\r\n[apply.sh:9] rm /etc/haproxy/certs/certs.pem\r\n[apply.sh:10] '[' '!' -s /etc/haproxy/certs/default.pem ']'\r\n[apply.sh:12] grep -q 'version 1.5'\r\n[apply.sh:12] haproxy -v\r\n[apply.sh:17] reload_haproxy /etc/haproxy/haproxy.cfg\r\n[scripts.sh:183] CONFIG=/etc/haproxy/haproxy.cfg\r\n[scripts.sh:185] '[' '!' -f /var/run/haproxy.pid ']'\r\n[[scripts.sh:190] cat /var/run/haproxy.pid\r\n[scripts.sh:190] haproxy -p /var/run/haproxy.pid -f /etc/haproxy/haproxy.cfg -sf 525\r\n[ALERT] 246/210438 (31324) : parsing [/etc/haproxy/haproxy.cfg:33] : 'bind 10.42.182.172:9798' : \r\n  unable to load SSL certificate from PEM file '/etc/haproxy/certs/server.pem'.\r\n  unable to load SSL certificate from PEM file '/etc/haproxy/certs/default.pem'.\r\n[ALERT] 246/210438 (31324) : parsing [/etc/haproxy/haproxy.cfg:48] : 'bind 10.42.182.172:9797' : \r\n  unable to load SSL certificate from PEM file '/etc/haproxy/certs/server.pem'.\r\n  unable to load SSL certificate from PEM file '/etc/haproxy/certs/default.pem'.\r\n[ALERT] 246/210438 (31324) : Error(s) found in configuration file : /etc/haproxy/haproxy.cfg\r\n[ALERT] 246/210438 (31324) : Proxy 'b4271e5f-3d9c-4256-abfa-1cf1b3578a5b_frontend': no SSL certificate specified for bind '10.42.182.172:9798' at [/etc/haproxy/haproxy.cfg:33] (use 'crt').\r\n[ALERT] 246/210438 (31324) : Proxy '6e156340-4375-4e89-800d-7a33601127c8_frontend': no SSL certificate specified for bind '10.42.182.172:9797' at [/etc/haproxy/haproxy.cfg:48] (use 'crt').\r\n[ALERT] 246/210438 (31324) : Fatal errors found in configuration.\r\n[scripts.sh:193] return 1\r\n``` \r\n\r\n\r\ncat key.pem \r\n-----BEGIN DSA PRIVATE KEY-----\r\nMIIE1wIBAAKCAYEA+DNVSnMHZrjuuMTS8uj3j4aN20B9bSg5ecExEYNB0BHI3w5T\r\n5EcXqBAR2vqdAUvXDTQ3TB/fRiJrbnCxqe9vaEh0Tisix4qIr+iJShsspcQbZd4o\r\nMtNE80vP67E43Qx/n1GAoGoDwj0eR9YTvipub1SqvZeNdMKsvH/5RB3x8efDC4Sb\r\nBqwgbNJmoclPp5m/vIhPJ1YHsF12z6ly8KQ9V4RMEDwE9yeIpx4iOdojRHaf2GJr\r\nHKK4xo4EIEL+SEy/6ssL4aSzS9g1aWxQs39b0+y47Dwv2Ef2yqNiYbqJOh87iMkn\r\nNcx5qRW8fJ+1/QCjR6OirF71ZG6kgZQQNNv1BxVGwwYWTdwfj62ruqHH5/Xu3baw\r\n9sArIkNHSQ9GiwqpPOH3FJEO2XF6Nbh3zqWPMojWteNi1/CrUFU9YU2RUy6u+Q0g\r\nZTgML3kMaPzOb+FysitNSah+YXCd1lmcDTQxdLECP8FadJO9ljeHclNmbw0yn6/n\r\nanGEVU4dKr0FkzzXAiEA2DwNkXqelaNVbQE/qpqdojipTpBtE80kKzm3xjzh3wcC\r\nggGBAIoCspk+XplSYI09pwcfujxsgPGNAxbwn7zIO87kc9whm4ZE2u1Aa9YTTWRl\r\nerLXRIR4GVo1N/s65jGxyloaUtDA2YiU4fr0pA8DrsIiKLVicfdRQgpaC8z/yv4A\r\nocpVb/Gy0xjOOypq/NZnV91Nl/ryMl8f2Mbo9iMztmtlFFGDczmErbKt8GzX+Nt6\r\nonAZ3gvfBbEP30j0jktdwOKuIaH7w25RsS+s9BaB7Oly1oMHJZPrBHyj+eSCk4Kk\r\nXYWbfk9CPcZI2w+ZHkPB2QjIRUPGI9KARNGK861+hnjl+ZzimmFKoT6fMIxD0hdf\r\nakQ3Mccy6KzhDAB4rLISZWv+uARNNuBg0nayXUX6Alw2X9FcLdiHnPKuXyFT8ryQ\r\n/ygeJEuZA7mehHEWlUyHTb7AiboeeBT1QLNfI0PGN9TDgsGQt5knATYWMe5l/dZM\r\noGI/MAiPixRn8r0rRylzukZQix+h04caRkzHLN8RABfQkciLmP6Xa3oPbIfBsLfs\r\ni5YQyAKCAYEAlogoYPKMxpg6aCmHp2QlLlkY4LlfTMcA4XqK7BGTUT0PUni6gTCe\r\nBzUtOEC/0+WuiclNrB5R3rnhNuMAd6ySVMOSt7ojWFcZn/zEzBW46DxpAkX4/OTw\r\nlXA2Ucz973DWDhMFiv0FrZU04zjVKLyXlpevOxHdt6mKLGjqjlOVi9er3kRZcb/Q\r\nrmETzbFf6k4ejrrKNiY1vM89F1TF6SugE2StWAepgw2/M2aQghBYg8SyUzefy46o\r\njaWMXBDNoUZLPIa/y9O8mXba89ZRLZ/NzAbNH1/0gTY3Psi10jlkN7cD/V3qTU2m\r\nsyx/zmwOdQDDxDzC3u5pVWBGOsCp1Yu63EF46GcCiH1I7xEEDSQB8KnWr+lHXNen\r\nJgvtWg6uOabAThEJ01azxB3i1Jwpi16nDSZbtxLHT5Fy2TGXn0cfmNCv3iP01y+J\r\n7MfvLI7fLVM2tVbN6mPB/A3OhtOD+kdWeoPPvWKX5kvIrFAiYxi/dw4Gwp9XVEDY\r\nuR5YlyRRKvO5AiBhY/Ho3/H/RnTbIDmz1E4hzUQbzt+VSrlruq8hZdbptw==\r\n-----END DSA PRIVATE KEY-----\r\n\r\n$ cat certificate.cer\r\n-----BEGIN CERTIFICATE-----\r\nMIIGbzCCBhQCCQD9kfIKwo892DALBglghkgBZQMEAwIwgYUxCzAJBgNVBAYTAlVT\r\nMQswCQYDVQQIDAJDQTESMBAGA1UEBwwJQ3VwZXJ0aW5vMQ8wDQYDVQQKDAZ0ZXN0\r\nbWUxDzANBgNVBAsMBnRlc3RtZTEVMBMGA1UEAwwMdGVzdDZkc2EuY29tMRwwGgYJ\r\nKoZIhvcNAQkBFg10ZXN0NkBhYmMuY29tMB4XDTE1MDkwNDE3NDE0N1oXDTE1MTAw\r\nNDE3NDE0N1owgYUxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTESMBAGA1UEBwwJ\r\nQ3VwZXJ0aW5vMQ8wDQYDVQQKDAZ0ZXN0bWUxDzANBgNVBAsMBnRlc3RtZTEVMBMG\r\nA1UEAwwMdGVzdDZkc2EuY29tMRwwGgYJKoZIhvcNAQkBFg10ZXN0NkBhYmMuY29t\r\nMIIEyDCCAzoGByqGSM44BAEwggMtAoIBgQD4M1VKcwdmuO64xNLy6PePho3bQH1t\r\nKDl5wTERg0HQEcjfDlPkRxeoEBHa+p0BS9cNNDdMH99GImtucLGp729oSHROKyLH\r\nioiv6IlKGyylxBtl3igy00TzS8/rsTjdDH+fUYCgagPCPR5H1hO+Km5vVKq9l410\r\nwqy8f/lEHfHx58MLhJsGrCBs0mahyU+nmb+8iE8nVgewXXbPqXLwpD1XhEwQPAT3\r\nJ4inHiI52iNEdp/YYmscorjGjgQgQv5ITL/qywvhpLNL2DVpbFCzf1vT7LjsPC/Y\r\nR/bKo2Jhuok6HzuIySc1zHmpFbx8n7X9AKNHo6KsXvVkbqSBlBA02/UHFUbDBhZN\r\n3B+Prau6ocfn9e7dtrD2wCsiQ0dJD0aLCqk84fcUkQ7ZcXo1uHfOpY8yiNa142LX\r\n8KtQVT1hTZFTLq75DSBlOAwveQxo/M5v4XKyK01JqH5hcJ3WWZwNNDF0sQI/wVp0\r\nk72WN4dyU2ZvDTKfr+dqcYRVTh0qvQWTPNcCIQDYPA2Rep6Vo1VtAT+qmp2iOKlO\r\nkG0TzSQrObfGPOHfBwKCAYEAigKymT5emVJgjT2nBx+6PGyA8Y0DFvCfvMg7zuRz\r\n3CGbhkTa7UBr1hNNZGV6stdEhHgZWjU3+zrmMbHKWhpS0MDZiJTh+vSkDwOuwiIo\r\ntWJx91FCCloLzP/K/gChylVv8bLTGM47Kmr81mdX3U2X+vIyXx/Yxuj2IzO2a2UU\r\nUYNzOYStsq3wbNf423qicBneC98FsQ/fSPSOS13A4q4hofvDblGxL6z0FoHs6XLW\r\ngwclk+sEfKP55IKTgqRdhZt+T0I9xkjbD5keQ8HZCMhFQ8Yj0oBE0YrzrX6GeOX5\r\nnOKaYUqhPp8wjEPSF19qRDcxxzLorOEMAHisshJla/64BE024GDSdrJdRfoCXDZf\r\n0Vwt2Iec8q5fIVPyvJD/KB4kS5kDuZ6EcRaVTIdNvsCJuh54FPVAs18jQ8Y31MOC\r\nwZC3mScBNhYx7mX91kygYj8wCI+LFGfyvStHKXO6RlCLH6HThxpGTMcs3xEAF9CR\r\nyIuY/pdreg9sh8Gwt+yLlhDIA4IBhgACggGBAJaIKGDyjMaYOmgph6dkJS5ZGOC5\r\nX0zHAOF6iuwRk1E9D1J4uoEwngc1LThAv9PlronJTaweUd654TbjAHesklTDkre6\r\nI1hXGZ/8xMwVuOg8aQJF+Pzk8JVwNlHM/e9w1g4TBYr9Ba2VNOM41Si8l5aXrzsR\r\n3bepiixo6o5TlYvXq95EWXG/0K5hE82xX+pOHo66yjYmNbzPPRdUxekroBNkrVgH\r\nqYMNvzNmkIIQWIPEslM3n8uOqI2ljFwQzaFGSzyGv8vTvJl22vPWUS2fzcwGzR9f\r\n9IE2Nz7ItdI5ZDe3A/1d6k1NprMsf85sDnUAw8Q8wt7uaVVgRjrAqdWLutxBeOhn\r\nAoh9SO8RBA0kAfCp1q/pR1zXpyYL7VoOrjmmwE4RCdNWs8Qd4tScKYtepw0mW7cS\r\nx0+Rctkxl59HH5jQr94j9NcviezH7yyO3y1TNrVWzepjwfwNzobTg/pHVnqDz71i\r\nl+ZLyKxQImMYv3cOBsKfV1RA2LkeWJckUSrzuTALBglghkgBZQMEAwIDSAAwRQIh\r\nANZMBSDvGiaKGsRbjFCMexyYELFkiLSZiu14sPILuAXYAiAvY7tPrRID0z1rbPXM\r\nGOOHqZZ6QTGeoF5p/xB8WAP+og==\r\n-----END CERTIFICATE-----\r\n\r\n"}}