Jira (PUP-2189) The CRL can get corrupted if two workers revoke certs at same time

[Nick Walker (JIRA)]

Title: Message Title

Nick Walker commented on PUP-2189   Re: The CRL can get corrupted if two workers revoke certs at same time Paul Raines something like this should work. Stop the puppetserver and puppet agent processes on the CA: sudo puppet resource service puppet ensure=stopped sudo puppet resource service puppetserver ensure=stopped Still on the CA, move and backup the existing ca_crl.pem and crl.pem files: mv /etc/puppetlabs/puppet/ssl/ca/ca_crl.pem /etc/puppetlabs/puppet/ssl/ca/ca_crl.pem-bk && mv /etc/puppetlabs/puppet/ssl/crl.pem /etc/puppetlabs/puppet/ssl/crl.pem-bk Generate a new crl by issuing and revoking a dummy certificate: puppet cert generate test puppet cert clean test Restart the agent and puppetserver processes: sudo puppet resource service puppet ensure=running sudo puppet resource service pe-puppetserver ensure=running Restarting the agent initiates an agent run that copies ca/ca_crl.pem to crl.pem. Any compile masters connected to the CA will refresh the copy of the crl.pem file on their next agent run. The new pair of crl files on the CA should now only show a single (matching) revoked certificate: /opt/puppetlabs/puppet/bin/openssl crl -in /etc/puppetlabs/puppet/ssl/ca/ca_crl.pem -noout -text | grep Serial Serial Number: 1F   /opt/puppetlabs/puppet/bin/openssl crl -in /etc/puppetlabs/puppet/ssl/crl.pem -noout -text | grep Serial Serial Number: 1F Add Comment   This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.