Jira (PUP-6179) Puppet CA face broken

[Eric Thompson (JIRA)]

Title: Message Title

Eric Thompson commented on PUP-6179   Re: Puppet CA face broken validated on rhel7 at puppet-agent master SHA: 0fea3002a9628da1a45f098c7eebc03925936836 [root@qkm8hxby9wwevs1 ~]# puppet ca list   [root@qkm8hxby9wwevs1 ~]# puppet cert list [root@qkm8hxby9wwevs1 ~]# puppet help ca   USAGE: puppet ca <action>   This provides local management of the Puppet Certificate Authority.   OPTIONS: --render-as FORMAT - The rendering format to use. --verbose - Whether to log verbosely. --debug - Whether to log debug information.   ACTIONS: destroy Destroy named certificate or pending certificate request. fingerprint Print the DIGEST (defaults to the signing algorithm) fingerprint of a host's certificate. generate Generate a certificate for a named client. list List certificates and/or certificate requests. print Print the full-text version of a host's certificate. revoke Add certificate to certificate revocation list. sign Sign an outstanding certificate request. verify Verify the named certificate against the local CA certificate.   See 'puppet man ca' or 'man puppet-ca' for full help. [root@qkm8hxby9wwevs1 ~]# puppet ca fingerprint $(hostname -f) (SHA256) AB:60:D4:C6:10:F5:8C:BD:5F:21:63:6C:FA:75:BD:10:09:15:30:CA:8A:B0:62:5C:74:B9:B8:D5:F4:AF:1D:74 [root@qkm8hxby9wwevs1 ~]# puppet ca fingerprint Error: puppet ca fingerprint takes 1 argument, but you gave 0 Error: Try 'puppet help ca fingerprint' for usage [root@qkm8hxby9wwevs1 ~]# puppet help ca list   USAGE: puppet ca list [--[no-]all] [--[no-]pending] [--[no-]signed] [--digest ALGORITHM] [--subject PATTERN]     This will list the current certificates and certificate signing requests in the Puppet CA. You will also get the fingerprint, and any certificate verification failure reported.   OPTIONS: --render-as FORMAT - The rendering format to use. --verbose - Whether to log verbosely. --debug - Whether to log debug information. --[no-]all - Include all certificates and requests. --digest ALGORITHM - The hash algorithm to use when displaying the fingerprint --[no-]pending - Include pending certificate signing requests. --[no-]signed - Include signed certificates. --subject PATTERN - Only list if the subject matches PATTERN.   See 'puppet man ca' or 'man puppet-ca' for full help. [root@qkm8hxby9wwevs1 ~]# puppet ca list --all Error: The certificate retrieved from the master does not match the agent's private key. Certificate fingerprint: 60:39:F9:2A:60:02:5F:41:03:9E:D0:86:A3:67:B3:92:76:28:58:94:EF:18:9F:C2:8A:30:E7:19:BF:29:FC:BE To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certficate. On the master: puppet cert clean qkm8hxby9wwevs1.delivery.puppetlabs.net On the agent: 1a. On most platforms: find /etc/puppetlabs/puppet/ssl -name qkm8hxby9wwevs1.delivery.puppetlabs.net.pem -delete 1b. On Windows: del "/etc/puppetlabs/puppet/ssl/qkm8hxby9wwevs1.delivery.puppetlabs.net.pem" /f 2. puppet agent -t   Error: Try 'puppet help ca list' for usage [root@qkm8hxby9wwevs1 ~]# puppet ca print $(hostname -f) Certificate: Data: Version: 3 (0x2) Serial Number: 2 (0x2) Signature Algorithm: sha256WithRSAEncryption Issuer: CN=Puppet CA: qkm8hxby9wwevs1.delivery.puppetlabs.net Validity Not Before: Apr 18 23:01:34 2016 GMT Not After : Apr 18 23:01:34 2021 GMT Subject: CN=qkm8hxby9wwevs1.delivery.puppetlabs.net Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: 00:c8:f8:75:be:3a:f9:0b:62:19:15:fd:c2:23:63: 6f:18:fc:08:dc:e4:ea:06:49:b9:28:73:a0:80:f5: b2:08:be:d4:a1:dc:70:7b:a1:88:01:dc:0f:b1:17: ee:e6:42:61:9c:79:18:eb:e4:75:61:f1:bd:79:86: 0a:e5:9b:b7:73:4b:f2:99:e5:4f:f0:53:11:89:6e: a9:03:f1:a4:2e:43:a2:5c:c7:eb:0e:a7:9f:00:80: 5b:b5:4c:51:cd:46:ee:cd:44:cb:6e:a1:55:84:f9: ef:64:47:90:77:8a:72:ca:1e:91:e0:a6:3b:2c:a9: 13:fa:1d:ff:ac:66:e2:51:47:91:b1:51:21:74:af: 9c:82:45:44:3a:c1:93:c1:5c:1a:84:4e:f5:f6:12: 18:68:5e:6c:1e:0b:9a:90:58:e7:e5:9a:54:2e:45: 11:0b:ce:1f:4e:46:e8:8e:b3:ec:bb:29:85:7d:3d: a7:01:1e:23:47:77:93:bc:04:88:b2:97:54:ff:48: 1f:24:7f:24:37:58:bc:cc:c1:0d:87:8c:1c:cb:c0: 00:06:fc:2d:b7:7b:4d:78:4b:d3:18:db:2c:51:7d: 5b:18:6a:60:1d:c3:c1:2f:60:5e:6a:1e:49:6e:b1: 33:8d:06:98:28:2f:4a:09:ad:63:8f:2d:69:ce:1c: 5f:09:7c:e0:e8:a8:56:64:61:ad:57:72:64:d9:62: 67:4d:d8:d4:b4:e0:7b:b6:55:76:1b:3e:97:0d:b2: some stuff seems strange, or requires an external ca, or i don't know how to use it. might change this to low priority, considering no one noticed this was broken and we have puppet cert face. can do more exploratory testing in next sprint when fulfilling the related ticket. Add Comment   This message was sent by Atlassian JIRA (v6.4.13#64028-sha1:b7939e9) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.