Jira (PUP-10424) if certname entry is not in [main] section of puppet.conf file provide a warning

[Michael Hudson (Jira)]

Title: Message Title

Michael Hudson commented on PUP-10424   Re: if certname entry is not in [main] section of puppet.conf file provide a warning I wanted to add an example of the issue in case it helps. In the example below you can see that 'puppet config print certname' returns fine when the certname setting is either not used (uses FQDN by default I believe) and also when certname is set in the [main] section of puppet.conf. When it is set in the [agent] section of puppet conf you can see that the original FQDN is returned instead of the certname, despite that the certname setting in this section does work for requesting a cert with that name.   No certname setting used (certname, and hostcert and hostprivkey config settings use FQDN as expected)   [root@mh-r7cer1735 ~]# cat /etc/puppetlabs/puppet/puppet.conf [main] server = puppetstack0.devint.sv.cloud.wellsfargo.net # This file can be used to override the default puppet settings. # See the following links for more details on what settings are available: # - https://puppet.com/docs/puppet/latest/config_important_settings.html # - https://puppet.com/docs/puppet/latest/config_about_settings.html # - https://puppet.com/docs/puppet/latest/config_file_main.html # - https://puppet.com/docs/puppet/latest/configuration.html[agent] noop = true runinterval = 24h digest_algorithm = sha256 splay = true   [root@mh-r7cer1735 ~]# puppet config print certname hostcert hostprivkey certname = mh-r7cer1735.devint.cloud.wellsfargo.net hostcert = /etc/puppetlabs/puppet/ssl/certs/mh-r7cer1735.devint.cloud.wellsfargo.net.pem hostprivkey = /etc/puppetlabs/puppet/ssl/private_keys/mh-r7cer1735.devint.cloud.wellsfargo.net.pem   certname in the agent section (certname, hostcert, or hostprivkey config settings NOT set correctly). In this case I would expect an error or warning that the certname is used in the wrong section since it is not being honored for everything that should use it (you can see that when requesting a new cert be signed it is honored for that action) [root@mh-r7cer1735 ~]# vi /etc/puppetlabs/puppet/puppet.conf [root@mh-r7cer1735 ~]# cat /etc/puppetlabs/puppet/puppet.conf [main] server = puppetstack0.devint.sv.cloud.wellsfargo.net # This file can be used to override the default puppet settings. # See the following links for more details on what settings are available: # - https://puppet.com/docs/puppet/latest/config_important_settings.html # - https://puppet.com/docs/puppet/latest/config_about_settings.html # - https://puppet.com/docs/puppet/latest/config_file_main.html # - https://puppet.com/docs/puppet/latest/configuration.html[agent] certname = foo.bar noop = true runinterval = 24h digest_algorithm = sha256 splay = true   [root@mh-r7cer1735 ~]# puppet config print certname hostcert hostprivkey certname = mh-r7cer1735.devint.cloud.wellsfargo.net hostcert = /etc/puppetlabs/puppet/ssl/certs/mh-r7cer1735.devint.cloud.wellsfargo.net.pem hostprivkey = /etc/puppetlabs/puppet/ssl/private_keys/mh-r7cer1735.devint.cloud.wellsfargo.net.pem   [root@mh-r7cer1735 ~]# mv /etc/puppetlabs/puppet/ssl /etc/puppetlabs/puppet/ssl.bak [root@mh-r7cer1735 ~]# puppet agent -t Info: Creating a new SSL key for foo.bar Info: Caching certificate for ca ... ...   certname in the main section (certname, hostcert, and hostprivkey config settings are set correctly) In this case everything works as expected, including the cert request and config settings.   [root@mh-r7cer1735 ~]# vi /etc/puppetlabs/puppet/puppet.conf [root@mh-r7cer1735 ~]# cat /etc/puppetlabs/puppet/puppet.conf [main] certname = foo.bar server = puppetstack0.devint.sv.cloud.wellsfargo.net # This file can be used to override the default puppet settings. # See the following links for more details on what settings are available: # - https://puppet.com/docs/puppet/latest/config_important_settings.html # - https://puppet.com/docs/puppet/latest/config_about_settings.html # - https://puppet.com/docs/puppet/latest/config_file_main.html # - https://puppet.com/docs/puppet/latest/configuration.html[agent] noop = true runinterval = 24h digest_algorithm = sha256 splay = true   [root@mh-r7cer1735 ~]# puppet config print certname hostcert hostprivkey certname = foo.bar hostcert = /etc/puppetlabs/puppet/ssl/certs/foo.bar.pem hostprivkey = /etc/puppetlabs/puppet/ssl/private_keys/foo.bar.pem   [root@mh-r7cer1735 ~]# rm -rf /etc/puppetlabs/puppet/ssl [root@mh-r7cer1735 ~]# puppet agent -t Info: Creating a new SSL key for foo.bar Info: Caching certificate for ca ... ...   Add Comment   This message was sent by Atlassian Jira (v8.5.2#805002-sha1:a66f935) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.355679.1586968778000.40640.1587076620044%40Atlassian.JIRA.