Jira (PUP-6115) The instructions for cleaning a Windows node's certificate are wrong

[Glenn Sarti (JIRA)]

Title: Message Title

Glenn Sarti commented on PUP-6115   Re: The instructions for cleaning a Windows node's certificate are wrong Repro Steps 1 Agent (Windows Server 2012 R2) 2 Masters (2 Learning VMs) Assumes the agent does not have any certs on the two masters git clone the PR bundle install etc. Change the hosts file on the agent to point puppet to Master #1 Delete C:\ProgramData\PuppetLabs\puppet\etc\ssl puppet agent -t Accept the cert on Master 1 puppet agent -t (Should do a succesful puppet run) Copy C:\ProgramData\PuppetLabs\puppet\etc\ssl to C:\ProgramData\PuppetLabs\puppet\etc\ssl.master1 Change the hosts file on the agent to point puppet to Master #2 Delete C:\ProgramData\PuppetLabs\puppet\etc\ssl puppet agent -t Accept the cert on Master 2 puppet agent -t (Should do a succesful puppet run) Copy C:\ProgramData\PuppetLabs\puppet\etc\ssl.master1\private_keys to C:\ProgramData\PuppetLabs\puppet\etc\ssl\private_keys puppet agent -t Should receive error message Debug: Using cached certificate for win-edson23cglf.localdomain Error: Could not request certificate: The certificate retrieved from the master does not match the agent's private key. Certificate fingerprint: DE:DF:DE:1E:B2:C6:9F:ED:61:64:20:40:EC:FA:77:01:7B:3A:FE:16:66:98:B7:C8:0B:05:FA:0E:EA:8C:98:F4 To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certificate. On the master: puppet cert clean win-edson23cglf.localdomain On the agent: 1a. On most platforms: find C:/ProgramData/PuppetLabs/puppet/etc/ssl -name win-edson23cglf.localdomain.pem -delete 1b. On Windows: del "C:\ProgramData\PuppetLabs\puppet\etc\ssl\certs\win-edson23cglf.localdomain.pem" /f 2. puppet agent -t     Exiting; failed to retrieve certificate and waitforcert is disabled Copied the text from the error message and ran in command prompt Microsoft Windows [Version 6.3.9600] (c) 2013 Microsoft Corporation. All rights reserved.   C:\Users\Administrator>del "C:\ProgramData\PuppetLabs\puppet\etc\ssl\certs\win-e dson23cglf.localdomain.pem" /f   C:\Users\Administrator>dir "C:\ProgramData\PuppetLabs\puppet\etc\ssl\certs\win-e dson23cglf.localdomain.pem" Volume in drive C has no label. Volume Serial Number is 2CF2-42EA   Directory of C:\ProgramData\PuppetLabs\puppet\etc\ssl\certs   File Not Found   C:\Users\Administrator> Add Comment   This message was sent by Atlassian JIRA (v6.4.13#64028-sha1:b7939e9) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.