Hi there,
I partially solved my question. Describing it here so others can find on
the mailing list archives.
That is, I solved only for remote-viewer on Windows. virt-viewer and
virsh still cannot connect using TLS.
I downloaded the latest virt-viewer installer for windows from
fedorahosted.org (0.5.7) and wish to use spice+tls to access VM
consoles from a Fedora machine. I know my certificates are properly
configured on the server side because I can connect from another
Fedora machine using both remote-viewer and virsh.
But on Windows it won't work. Virt-viewer was installed on the default
location, so I guessed I had to put cacert.pem on:
"C:\Program Files (x86)\VirtViewer\etc\pki\CA"
and the client certificates on:
"C:\Program Files (x86)\VirtViewer\etc\pki\libvirt"
Connections to libvirtd and to a spice server use different TLS setups.
I was mistaken beliving it was ok on my Linux machines, the fact was
they were connecting using TLS to libvirtd but then using an insecure
spice connection to the guest consoles. The same setup solved both Linux
and windows issues regarding spice, but those info is not easy to find.
The CA certificate configured on the kvm host (saved as
"/etc/pki/CA/cacert.pem") has to be copied to
$HOME/.spicec/spice_trusstore.pem. A symbolic link also works fine.
On Windows, you have to copy the CA cert "spice_trustore.pem" to
"C:\Users\<YourUser>\.spicec". Note Windows Explorer will refuse to
create a folder name starting with a dot, so you'll have to use the
Windows Command Prompt.
Then you can use connection URLs like "spice://kvmhost?tls-port=5901"
and be assured you'll use only TLS connections to the spice display
(checked using netstat on both Linux server and Windows client).
When I try to connect to the host using virsh.exe included on
viet-viewer install I get the error:
virsh # connect qemu://kvmserv/system
error: Failed to connect to the hypervisor
error: Cannot read CA certificate
'/usr/i686-w64-mingw32/sys-root/mingw/etc/pki/
CA/cacert.pem': No such file or directory
virsh # connect qemu+tls://kvmserv/system
error: Failed to connect to the hypervisor
error: Cannot read CA certificate
'/usr/i686-w64-mingw32/sys-root/mingw/etc/pki/
CA/cacert.pem': No such file or directory
I still can't find where to put certificates for virsh on Windows to
work. :-( I tried creating a ".pki\libvirt" folder on the "home" dir
("c:\users\<my user name>") as a $HOME/.pki/libvirt works for linux
clients. This worked for ".spicec" and remote-viewer for windows, but
not for virsh and virt-viewer for Windows. I still get the same error
from virsh for Windows. If I had strace for Windows!
PS: virt-viewer on WIndows complained about a missing DDL. I got one from:
http://qemu.weilnetz.de/w32/dll/libssp-0.dll
And thus virt-viewer stopped complaining. But it can't connect to
libvirtd on the host yet. I assume by the same reason virsh can't: they
cannot find the certificates. But virt-viewer only tells "unable to
connect to libvirtd with URI..."
[]s, Fernando Lozano
_______________________________________________
Spice-devel mailing list
Spice-devel@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/spice-devel