openstack的vnc启动ssl

tangbinde

　　1、制作ssl证书
# cd /etc/pki/tls/certs
[root@www certs]# make vnc.key
Enter pass phrase:# 输入密码
Verifying - Enter pass phrase:#确认　　


　　# 从private key 中删除密码
# openssl rsa -in vnc.key -out vnc.key
# make vnc.csr
Country Name (2 letter code) [XX]:CN# 国家
State or Province Name (full name) []:shanghai   # 省
Locality Name (eg, city) [Default City]: shanghai   # 市
Organization Name (eg, company) [Default Company Ltd]:openstack  # 公司
Organizational Unit Name (eg, section) []:Server World   # 部门
Common Name (eg, your name or your server's hostname) []:www.srv.world   # 主机名
Email Address []:xxx@srv.world # 邮箱
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:#回车
An optional company name []:# Enter　　

# openssl x509 -in vnc.csr -out vnc.crt -req -signkey vnc.key -days 3650
Signature ok
subject=/C=CN/ST=shanghai/L=shanghai/O=openstack/OU=computer/CN=www.openstack.com/emailAddress=example@openstack.com
Getting Private key　　2、拷贝证书：
# cp -a vnc.key /etc/pki/tls/private　　3、赋予权限：
# chown nova:nova  /etc/pki/tls/private/vnc.key
# chown nova:nova  /etc/pki/tls/certs/vnc.crt　　4、在controller上配置nova.conf
[DEFAULT]
ssl_only=True
cert=/etc/pki/tls/certs/vnc.crt
key=/etc/pki/tls/private/vnc.key
[vnc]
novncproxy_base_url = https://192.168.8.100:6080/vnc_auto.html　　

　　5、在computer上配置nova.conf
[vnc]
novncproxy_base_url = https://192.168.8.100:6080/vnc_auto.html　　

　　
　　6、controller重启nova服务
# systemctl | grep nova | awk -F " " '{print$1}' | xargs systemctl restart　　7、Computer上重启服务
# systemctl | grep nova | awk -F " " '{print$1}' | xargs systemctl restart　　8、验证：