Jira (PUP-8918) Finalize separation of CA from Ruby

[Josh Cooper (JIRA)]

Title: Message Title

Josh Cooper commented on PUP-8918   Re: Finalize separation of CA from Ruby One gradual step might be to create a new ca directory outside of the existing ssl directory, and symlink from ssl/ca -> ca. This way rm -rf will unlink the symlink, but not follow it: [root@w4jl4a7y7wi0c0j puppet]# ln -s /etc/puppetlabs/puppet/ca /etc/puppetlabs/puppet/ssl/ca [root@w4jl4a7y7wi0c0j puppet]# chown puppet:puppet /etc/puppetlabs/puppet/ca [root@w4jl4a7y7wi0c0j puppet]# systemctl start puppetserver [root@w4jl4a7y7wi0c0j puppet]# /opt/puppetlabs/puppet/bin/puppet config set server `facter fqdn` --section main [root@w4jl4a7y7wi0c0j puppet]# /opt/puppetlabs/puppet/bin/puppet agent -t Info: Using configured environment 'production' Info: Retrieving pluginfacts Info: Retrieving plugin Info: Retrieving locales Info: Caching catalog for w4jl4a7y7wi0c0j.delivery.puppetlabs.net Info: Applying configuration version '1564090147' Notice: Applied catalog in 0.02 seconds [root@w4jl4a7y7wi0c0j puppet]# rm -rf /etc/puppetlabs/puppet/ssl/ [root@w4jl4a7y7wi0c0j puppet]# find ca/ ca/ ca/requests ca/signed ca/signed/w4jl4a7y7wi0c0j.delivery.puppetlabs.net.pem ca/serial ca/infra_inventory.txt ca/infra_serials ca/inventory.txt ca/ca_pub.pem ca/ca_key.pem ca/ca_crt.pem ca/ca_crl.pem ca/infra_crl.pem [root@w4jl4a7y7wi0c0j puppet]# /opt/puppetlabs/puppet/bin/puppet agent -t Error: CA certificate is missing from the server Error: Could not run: CA certificate is missing from the server [root@w4jl4a7y7wi0c0j puppet]# systemctl restart puppetserver [root@w4jl4a7y7wi0c0j puppet]# /opt/puppetlabs/puppet/bin/puppet agent -t Info: Using configured environment 'production' Info: Retrieving pluginfacts Info: Retrieving plugin Info: Retrieving locales Info: Caching catalog for w4jl4a7y7wi0c0j.delivery.puppetlabs.net Info: Applying configuration version '1564090533' Notice: Applied catalog in 0.01 seconds That said we'd need to make sure permissions are correct on the new ca directory, as I don't think puppet will follow the link when applying the settings catalog. Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.259819.1528471767000.31851.1564090680229%40Atlassian.JIRA.