Jira (PUP-5349) only the ca server is veryfing puppet client certificates

[Leif M (Jira)]

Title: Message Title

Leif M commented on PUP-5349   Re: only the ca server is veryfing puppet client certificates I've re-opened this ticket as I seem to be encountering the same issue with Puppet server 6.3.3. We have 3 Puppet servers behind a load balancer + our Puppet CA, which is not itself behind the LB. When we revoke a certificate on the CA, the host with the revoked certificate is no longer able to execute agent runs against the CA server, but agent runs continue to work against the LB or any of the individual servers behind it. After revoking a host's certificate, the puppet CA server rejects its agent runs. I've confirmed that agent runs work against the CA before the cert is revoked. $ /opt/puppetlabs/bin/puppet agent -t --server puppet-ca.example.com Error: Request to https://puppet-ca.example.com:8140/puppet/v3 failed after 0.069 seconds: SSL_connect returned=1 errno=0 state=error: sslv3 alert certificate unknown Wrapped exception: SSL_connect returned=1 errno=0 state=error: sslv3 alert certificate unknown Warning: Unable to fetch my node definition, but the agent run will continue: Warning: No more routes to puppet Info: Retrieving pluginfacts Error: Request to https://puppet-ca.example.com:8140/puppet/v3 failed after 0.049 seconds: SSL_connect returned=1 errno=0 state=error: sslv3 alert certificate unknown Wrapped exception: SSL_connect returned=1 errno=0 state=error: sslv3 alert certificate unknown Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Failed to generate additional resources using 'eval_generate': No more routes to fileserver Error: Request to https://puppet-ca.example.com:8140/puppet/v3 failed after 0.069 seconds: SSL_connect returned=1 errno=0 state=error: sslv3 alert certificate unknown Wrapped exception: SSL_connect returned=1 errno=0 state=error: sslv3 alert certificate unknown Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet:///pluginfacts: No more routes to fileserver Info: Retrieving plugin Error: Request to https://puppet-ca.example.com:8140/puppet/v3 failed after 0.056 seconds: SSL_connect returned=1 errno=0 state=error: sslv3 alert certificate unknown Wrapped exception: SSL_connect returned=1 errno=0 state=error: sslv3 alert certificate unknown Error: /File[/opt/puppetlabs/puppet/cache/lib]: Failed to generate additional resources using 'eval_generate': No more routes to fileserver Error: Request to https://puppet-ca.example.com:8140/puppet/v3 failed after 0.058 seconds: SSL_connect returned=1 errno=0 state=error: sslv3 alert certificate unknown Wrapped exception: SSL_connect returned=1 errno=0 state=error: sslv3 alert certificate unknown Error: /File[/opt/puppetlabs/puppet/cache/lib]: Could not evaluate: Could not retrieve file metadata for puppet:///plugins: No more routes to fileserver Info: Loading facts Error: Request to https://puppet-ca.example.com:8140/puppet/v3 failed after 0.055 seconds: SSL_connect returned=1 errno=0 state=error: sslv3 alert certificate unknown Wrapped exception: SSL_connect returned=1 errno=0 state=error: sslv3 alert certificate unknown Error: Could not retrieve catalog from remote server: No more routes to puppet Warning: Not using cache on failed catalog Error: Could not retrieve catalog; skipping run Error: Request to https://puppet-ca.example.com:8140/puppet/v3 failed after 0.063 seconds: SSL_connect returned=1 errno=0 state=error: sslv3 alert certificate unknown Wrapped exception: SSL_connect returned=1 errno=0 state=error: sslv3 alert certificate unknown Error: Could not send report: No more routes to report But agent runs continue to work when executed against the load balancer or any of our 3 other puppet servers. $ /opt/puppetlabs/bin/puppet agent -t --server puppet-server.example.com Info: Using configured environment 'ENVIRONMENT' Info: Retrieving pluginfacts Info: Retrieving plugin Info: Retrieving locales Info: Loading facts Info: Caching catalog for a-host.example.com Info: Applying configuration version '1589922090' Notice: Applied catalog in 4.97 seconds I have tried restarting the puppetserver service on the CA as well as the other individual Puppet server I've been using to test. I've tried copying crl.pem from the CA to the server I am using to test and placing it in both of these locations (since I found it in both locations on the CA): /etc/puppetlabs/puppet/ssl/ca/ca_crl.pem /etc/puppetlabs/puppet/ssl/crl.pem I then restarted the puppetserver service on the server; this didn't have any effect. Up until this point I was naively working under the assumption that the masters were checking in with the CA regarding cert validity, but that doesn't seem to be the case. Add Comment   This message was sent by Atlassian Jira (v8.5.2#805002-sha1:a66f935) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.101226.1444427929000.65925.1589923740492%40Atlassian.JIRA.