Comment 2 for bug 1883591

I faced similar issue wherein I was unable to retrieve cert using juju run-action vault/leader --wait get-root-ca. It was returning output as none. Is it expected behavior?

to retrive the cert as mentioned in initial comment I extracted cert by ssh into keystone container
/usr/local/share/ca-certificates/keystone_juju_ca_cert.crt . Copied the same in OS_CACERT variable to make openstack client CLI work.