Jira (PUP-2018) `puppet certificate generate` Generates Two CSRs in One Run

[R.I.Pienaar (JIRA)]

Title: Message Title

R.I.Pienaar commented on PUP-2018   Re: `puppet certificate generate` Generates Two CSRs in One Run Eric Sorenson repro steps..I dont think puppet cert can talk to remote CAs so not sure if it does the exact same thing Here I expect just one cert made but it makes the new one and then the fqdn one - which the master already have and so i get the wrong key error If I set --certname rip.mcollective (to match the requested cert) it attempts to make the same cert twice. % rm -rf .puppetlabs/etc/puppet/ssl % puppet --version 4.5.2 % ls /home/rip/.puppetlabs/etc/puppet/csr_attributes.yaml ls: cannot access /home/rip/.puppetlabs/etc/puppet/csr_attributes.yaml: No such file or directory % puppet certificate generate rip.mcollective --ca-location remote --ca_server dev5.devco.net --debug --verbose .... Info: Creating a new SSL key for rip.mcollective Info: csr_attributes file loading from /home/rip/.puppetlabs/etc/puppet/csr_attributes.yaml Info: Creating a new SSL certificate request for rip.mcollective Info: Certificate Request fingerprint (SHA256): 36:A7:C0:2B:14:21:36:7D:03:33:35:5D:DF:C6:45:82:8E:20:7F:97:82:45:79:30:60:46:E8:E4 :04:B9:40:56 Info: Creating a new SSL key for dev3.devco.net Debug: Creating new connection for https://dev5.devco.net:8140 Info: Caching certificate for ca Debug: Creating new connection for https://dev5.devco.net:8140 Info: Caching certificate for dev3.devco.net Error: The certificate retrieved from the master does not match the agent's private key. Certificate fingerprint: 5F:38:23:92:F8:10:31:DB:D5:FF:08:D9:AA:A7:EE:89:DB:9D:B4:31:4C:81:0C:72:C7:9F:1B:E4:C6:62:AC:11 To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regene rate a certficate. On the master: puppet cert clean dev3.devco.net On the agent: 1a. On most platforms: find /home/rip/.puppetlabs/etc/puppet/ssl -name dev3.devco.net.pem -delete 1b. On Windows: del "/home/rip/.puppetlabs/etc/puppet/ssl/dev3.devco.net.pem" /f 2. puppet agent -t   Error: Try 'puppet help certificate generate' for usage Add Comment   This message was sent by Atlassian JIRA (v6.4.13#64028-sha1:b7939e9) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.