Mailing-List: contact user-help@jclouds.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@jclouds.apache.org
Received-SPF: pass (athena.apache.org: domain of yurykats@yahoo.com designates
 98.139.212.174 as permitted sender)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s2048; d=yahoo.com;
	b=LpNv2rYqR+WAqZTLdYg7xpwl5/+X1oaTSJp8e6e905eVkAlfucBsRx1rsfZA4G4lCO3kMOvOjlH3aYgX/i981Bj1GsgsdEgmOmt3df1sN5JGUl7u8AyVBL8UMHAqtTnleV48ozylCP6T2vjzg/4RpurZhtaoHbnoArX/IXdnq/7Q56V4vwwX8m0ir1qA07khaWJ+D4QdJxV02rYMcAY/BdoFZs3OdSD1omKoS61kfHRIda6eSzfyF2ytEaTttDhudb5tIv7supBpiyNlj+/Bz+fYcpbxdSWBf5N6Hg6sRLYZa7Dv17hWNhudUkC2TzXbYZOdqJM6+MGNmT9rgVIOCg==;
Message-ID: <542DCDB7.9020304@yahoo.com>
Date: Thu, 02 Oct 2014 18:12:07 -0400
From: Yury Kats <yurykats@yahoo.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
 rv:1.7.10) Gecko/20050716 Thunderbird/1.0.6 Mnenhy/0.7.1
MIME-Version: 1.0
To: user@jclouds.apache.org
Subject: Self-signed certs
Content-Type: text/plain; charset=koi8-r
Content-Transfer-Encoding: 7bit

I'm using jclouds 1.8 to communicate with Openstack Keystone server.
The server is using a self-signed cert. My client detects SSL connection failure and allows the user to install the cert, which I add to JVM's trust store.

At this point I expect jclouds connections to succeed, but they continue to fail. Until I shutdown the client and restart.
If the JVM trust store is loaded with the cert before jclouds makes its first connection, all is good.
But if I change (add/remove) certs after the 1st connection is made, then the change in JVM's trust store does not take effect on jclouds.
(For reference, I'm using AWS SDK in the same client, and there the change takes effect immediately).

Does jclouds cache connections or contexts? Is there a way to make it "fully reconnect" (for a lack of a better term)?

My code to talk to Keystone is like this:
        KeystoneApi keystoneAPI = ContextBuilder.newBuilder(new KeystoneApiMetadata())
                .endpoint(url)
                .credentials(tenant + ":" + user, key)
                .buildApi(KeystoneApi.class);

	keystoneAPI.getServiceApi().listTenants();

PS: I am aware of Constants.PROPERTY_TRUST_ALL_CERTS, but that's not what I want.

Thanks,
Yury