Images have cryptographic signature verification enabled

​

What this check verifies

OpenStack images are evaluated to verify that all four signature properties are configured: img_signature, img_signature_hash_method, img_signature_key_type, and img_signature_certificate_uuid. Signed images allow Nova to verify integrity before booting, detecting tampering or corruption.

​

Risk

Unsigned images can be tampered with to inject backdoors, malware, or rootkits without detection. Without signature verification, compromised storage backends or man-in-the-middle attacks can modify images between upload and boot. Nova cannot verify the integrity of unsigned images, allowing corrupted or malicious images to be launched.

​

Recommendation

Sign all production images using Barbican-managed certificates. Enable signature verification in Nova (verify_glance_signatures=True). Implement an image signing pipeline in CI/CD. Regularly rotate signing certificates and audit image signatures.

​

Remediation

Dashboard steps Sign images using Barbican:

1. Create a signing key and certificate in Barbican
2. Sign the image data with the private key
3. Upload the image with signature properties: openstack image create --property img_signature=<base64_signature> --property img_signature_hash_method=SHA-256 --property img_signature_key_type=RSA-PSS --property img_signature_certificate_uuid=<barbican_cert_uuid> <image_name>
4. Configure Nova to verify signatures: set verify_glance_signatures = True in nova.conf

​

References

• https://docs.openstack.org/security-guide/image-storage/checklist.html
• https://docs.openstack.org/glance/latest/user/signature.html

​

Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = image_signature_verification_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to OpenStack checks