Jira (PUP-5711) Uppercase characters in certname cause pain and suffering

Title: Message Title

PUP-5711

I have seen the same issue. I ran the issue with strace and debugging and it seems that it is a internal bug in puppet agent causing this issue.

Running with a UPPERCASE entry as certname in puppet.conf, the agent just uses it. Providing it on the command line, puppet aborts:

[root@WEBSERVER01 ~]# puppet agent --onetime --test --certname WEBSERVER01.vagrant.local

Error: Could not initialize global default settings: Certificate names must be lower case; see #1168

With config file the setting is just used blindly:

/etc/puppetlabs/puppet/puppet.conf:

[agent]

    certname = WEBSERVER01.vagrant.local

Then the error described here pops up. Strace shows:

3585  stat("/etc/puppetlabs/puppet/ssl/certs/WEBSERVER01.vagrant.local.pem", 0x7ffe86667c20) = -1 ENOENT (No such file or directory)

Enabeling SSL Logging an a reverse proxy in front of Puppetmaster shows:

SSL_CLIENT_S_DN - "(null)"

SSL_CLIENT_VERIFY - "NONE"

In difference with lowercase hostnames we get:

SSL_CLIENT_S_DN - "CN=webserver01.vagrant.local"

SSL_CLIENT_VERIFY - "SUCCESS"

Copying the certificate on the puppet agent (webserver01) resolved the issue:

cp -a /etc/puppetlabs/puppet/ssl/certs/webserver01.vagrant.local.pem /etc/puppetlabs/puppet/ssl/certs/WEBSERVER01.vagrant.local.pem

Then this works:

[root@WEBSERVER01 ~]# puppet agent --onetime --test

Info: Using configured environment 'production'

Info: Retrieving pluginfacts

Info: Retrieving plugin

My Conclusion:

Puppet could handle uppercase and lowercase hostnames as certname transparently if the agent would just use the correct certfile (which must be normalized the same way as done during creation of the cert request, where the generation is handled well).

Add Comment

This message was sent by Atlassian JIRA

--
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To post to this group, send email to [email protected].
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.

Reply via email to