)]}'
{"templates/keystone-httpd.conf.j2":[{"author":{"_account_id":25023,"name":"Jonathan Rosser","email":"jonathan.rosser@rd.bbc.co.uk","username":"jrosser"},"change_message_id":"d954e2a08967e0e32ef786c25a3e3eca743567f4","unresolved":true,"context_lines":[{"line_number":30,"context_line":"    SSLEngine on"},{"line_number":31,"context_line":"    SSLCertificateFile    {{ keystone_ssl_cert }}"},{"line_number":32,"context_line":"    SSLCertificateKeyFile {{ keystone_ssl_key }}"},{"line_number":33,"context_line":"    {% if keystone_user_ssl_ca_cert is defined or keystone_pki_create_ca | bool -%}"},{"line_number":34,"context_line":"    SSLCACertificateFile  {{ keystone_ssl_ca_cert }}"},{"line_number":35,"context_line":"    {% endif -%}"},{"line_number":36,"context_line":"    SSLCompression Off"}],"source_content_type":"text/x-jinja2","patch_set":1,"id":"38ec099c_de44b0d7","line":33,"range":{"start_line":33,"start_character":50,"end_line":33,"end_character":72},"updated":"2023-04-04 17:59:24.000000000","message":"not sure about this, see https://opendev.org/openstack/openstack-ansible-os_keystone/src/branch/master/defaults/main.yml#L262\n\nThis is the CA used when keystone is an IDP, not for use on the API service.","commit_id":"fad35159429d2fd45ebbb6c6bc7ef0b6e74502be"},{"author":{"_account_id":32666,"name":"Damian Dąbrowski","email":"damian@dabrowski.cloud","username":"ddabrowski"},"change_message_id":"a686dd1783b0f135d88fb005407cbd455b292a34","unresolved":false,"context_lines":[{"line_number":30,"context_line":"    SSLEngine on"},{"line_number":31,"context_line":"    SSLCertificateFile    {{ keystone_ssl_cert }}"},{"line_number":32,"context_line":"    SSLCertificateKeyFile {{ keystone_ssl_key }}"},{"line_number":33,"context_line":"    {% if keystone_user_ssl_ca_cert is defined or keystone_pki_create_ca | bool -%}"},{"line_number":34,"context_line":"    SSLCACertificateFile  {{ keystone_ssl_ca_cert }}"},{"line_number":35,"context_line":"    {% endif -%}"},{"line_number":36,"context_line":"    SSLCompression Off"}],"source_content_type":"text/x-jinja2","patch_set":1,"id":"89b3332e_f2d75e35","line":33,"range":{"start_line":33,"start_character":50,"end_line":33,"end_character":72},"in_reply_to":"38ec099c_de44b0d7","updated":"2023-04-07 23:40:13.000000000","message":"I\u0027m not really into IDP but you\u0027re right that this change is wrong.\n\nApache needs to respond with all intermediate certs but they should be included in pem file instead of leveraging SSLCACertificateFile.\n\nI fixed that in:\n879914: Use chain cert file for apache | https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/879914\n\nAbandoning this change","commit_id":"fad35159429d2fd45ebbb6c6bc7ef0b6e74502be"}]}