Many thanks for the explanation.

If you suppose cookbook will generate self-signed certs that this block should be executed after the https://github.com/vuntz/barclamp-keystone/blob/b17d41df8a97bd064928e5ebaaf2b5560e9340dd/chef/cookbooks/keystone/recipes/server.rb#L235
and inside ruby_block. I'll make a fix someday later.