Jira (PUP-7903) Do not cache invalid node certificate from puppet master

[Josh Cooper (JIRA)]

Title: Message Title

Josh Cooper commented on PUP-7903   Re: Do not cache invalid node certificate from puppet master I could reproduce in 6.0.2. On the agent: root@yshmwpc0eswbike:~# /opt/puppetlabs/bin/puppet agent -t Info: Downloaded certificate for ca from m39w9su5mxzqhm8.delivery.puppetlabs.net Info: csr_attributes file loading from /etc/puppetlabs/puppet/csr_attributes.yaml Info: Creating a new SSL certificate request for yshmwpc0eswbike.delivery.puppetlabs.net Info: Certificate Request fingerprint (SHA256): F1:F6:01:05:E7:9B:FE:3F:97:66:A3:6D:7D:61:3B:C1:EA:CA:16:D5:24:BF:F4:50:5B:BD:2F:C8:D0:64:75:91 Exiting; no certificate found and waitforcert is disabled Sign cert on the master root@yshmwpc0eswbike:~# /opt/puppetlabs/bin/puppet agent -t Info: Downloaded certificate for yshmwpc0eswbike.delivery.puppetlabs.net from m39w9su5mxzqhm8.delivery.puppetlabs.net Info: Using configured environment 'production' Info: Retrieving pluginfacts Info: Retrieving plugin Info: Retrieving locales Info: Caching catalog for yshmwpc0eswbike.delivery.puppetlabs.net Info: Applying configuration version '1538777345' Info: Creating state file /opt/puppetlabs/puppet/cache/state/state.yaml Notice: Applied catalog in 0.02 seconds Delete ssl directory from the agent, and run it again: root@yshmwpc0eswbike:~# rm -rf /etc/puppetlabs/puppet/ssl/ root@yshmwpc0eswbike:~# /opt/puppetlabs/bin/puppet agent -t Info: Creating a new SSL key for yshmwpc0eswbike.delivery.puppetlabs.net Info: Downloaded certificate for ca from m39w9su5mxzqhm8.delivery.puppetlabs.net Info: Downloaded certificate for yshmwpc0eswbike.delivery.puppetlabs.net from m39w9su5mxzqhm8.delivery.puppetlabs.net Error: Could not request certificate: The certificate retrieved from the master does not match the agent's private key. Did you forget to run as root? Certificate fingerprint: 36:E4:BD:C2:A2:5C:4E:07:CE:69:5E:A3:7D:09:6C:D6:A5:57:DC:BA:15:43:5F:54:1D:0E:62:D1:43:4E:95:F1 To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certificate. On the master: puppetserver ca clean --certname yshmwpc0eswbike.delivery.puppetlabs.net On the agent: 1a. On most platforms: find /etc/puppetlabs/puppet/ssl -name yshmwpc0eswbike.delivery.puppetlabs.net.pem -delete 1b. On Windows: del "\etc\puppetlabs\puppet\ssl\certs\yshmwpc0eswbike.delivery.puppetlabs.net.pem" /f 2. puppet agent -t   Exiting; failed to retrieve certificate and waitforcert is disabled Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.