diff --git a/requirements.txt b/requirements.txt
index ebb23c3..b877312 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -12,16 +12,16 @@
 python-ceilometerclient>=1.0.6
 python-glanceclient>=0.15.0
 python-keystoneclient>=1.1.0
-python-novaclient>=2.18.0
-python-neutronclient>=2.3.6,<3
+python-novaclient>=2.18.0,!=2.21.0
+python-neutronclient>=2.3.11,<3
 python-cinderclient>=1.1.0
-python-heatclient>=0.2.9
+python-heatclient>=0.3.0
 python-ironicclient>=0.2.1
 python-saharaclient>=0.7.6
 python-swiftclient>=2.2.0
 testrepository>=0.0.18
 oslo.config>=1.6.0  # Apache-2.0
-six>=1.7.0
+six>=1.9.0
 iso8601>=0.1.9
 fixtures>=0.3.14
 testscenarios>=0.4
diff --git a/tempest/common/accounts.py b/tempest/common/accounts.py
index dd8d498..9ecf596 100644
--- a/tempest/common/accounts.py
+++ b/tempest/common/accounts.py
@@ -100,7 +100,7 @@
         hash_path = os.path.join(self.accounts_dir, hash_string)
         if not os.path.isfile(hash_path):
             LOG.warning('Expected an account lock file %s to remove, but '
-                        'one did not exist')
+                        'one did not exist' % hash_path)
         else:
             os.remove(hash_path)
             if not os.listdir(self.accounts_dir):
diff --git a/tempest/scenario/test_network_basic_ops.py b/tempest/scenario/test_network_basic_ops.py
index 7f01182..132afda 100644
--- a/tempest/scenario/test_network_basic_ops.py
+++ b/tempest/scenario/test_network_basic_ops.py
@@ -17,7 +17,6 @@
 import re
 
 import testtools
-from testtools.tests import matchers
 
 from tempest.common.utils import data_utils
 from tempest import config
@@ -432,16 +431,6 @@
             should_connect=True, msg="after updating "
             "admin_state_up of router to True")
 
-    def _check_dns_server(self, ssh_client, dns_servers):
-        servers = ssh_client.get_dns_servers()
-        self.assertEqual(set(dns_servers), set(servers),
-                         'Looking for servers: {trgt_serv}. '
-                         'Retrieved DNS nameservers: {act_serv} '
-                         'From host: {host}.'
-                         .format(host=ssh_client.ssh_client.host,
-                                 act_serv=servers,
-                                 trgt_serv=dns_servers))
-
     @testtools.skipUnless(CONF.scenario.dhcp_client,
                           "DHCP client is not available.")
     @test.attr(type='smoke')
@@ -486,7 +475,15 @@
         private_key = self._get_server_key(server)
         ssh_client = self._ssh_to_server(ip_address, private_key)
 
-        self._check_dns_server(ssh_client, [initial_dns_server])
+        dns_servers = [initial_dns_server]
+        servers = ssh_client.get_dns_servers()
+        self.assertEqual(set(dns_servers), set(servers),
+                         'Looking for servers: {trgt_serv}. '
+                         'Retrieved DNS nameservers: {act_serv} '
+                         'From host: {host}.'
+                         .format(host=ssh_client.ssh_client.host,
+                                 act_serv=servers,
+                                 trgt_serv=dns_servers))
 
         self.subnet.update(dns_nameservers=[alt_dns_server])
         # asserts that Neutron DB has updated the nameservers
@@ -501,9 +498,7 @@
             subnet-update API call returns.
             """
             ssh_client.renew_lease(fixed_ip=floating_ip['fixed_ip_address'])
-            try:
-                self._check_dns_server(ssh_client, [alt_dns_server])
-            except matchers.MismatchError:
+            if ssh_client.get_dns_servers() != [alt_dns_server]:
                 LOG.debug("Failed to update DNS nameservers")
                 return False
             return True
diff --git a/tempest/services/botoclients.py b/tempest/services/botoclients.py
index 50d0779..1cbdb0c 100644
--- a/tempest/services/botoclients.py
+++ b/tempest/services/botoclients.py
@@ -39,7 +39,7 @@
         # FIXME(andreaf) replace credentials and auth_url with auth_provider
 
         insecure_ssl = CONF.identity.disable_ssl_certificate_validation
-        ca_cert = CONF.identity.ca_certificates_file
+        self.ca_cert = CONF.identity.ca_certificates_file
 
         self.connection_timeout = str(CONF.boto.http_socket_timeout)
         self.num_retries = str(CONF.boto.num_retries)
@@ -49,7 +49,7 @@
                         "auth_url": auth_url,
                         "tenant_name": tenant_name,
                         "insecure": insecure_ssl,
-                        "cacert": ca_cert}
+                        "cacert": self.ca_cert}
 
     def _keystone_aws_get(self):
         # FIXME(andreaf) Move EC2 credentials to AuthProvider
@@ -77,6 +77,16 @@
         boto.config.set("Boto", "http_socket_timeout", timeout)
         boto.config.set("Boto", "num_retries", retries)
 
+    def _config_boto_ca_certificates_file(self, ca_cert):
+        if ca_cert is None:
+            return
+
+        try:
+            boto.config.add_section("Boto")
+        except ConfigParser.DuplicateSectionError:
+            pass
+        boto.config.set("Boto", "ca_certificates_file", ca_cert)
+
     def __getattr__(self, name):
         """Automatically creates methods for the allowed methods set."""
         if name in self.ALLOWED_METHODS:
@@ -94,6 +104,7 @@
 
     def get_connection(self):
         self._config_boto_timeout(self.connection_timeout, self.num_retries)
+        self._config_boto_ca_certificates_file(self.ca_cert)
         if not all((self.connection_data["aws_access_key_id"],
                    self.connection_data["aws_secret_access_key"])):
             if all([self.ks_cred.get('auth_url'),