Jira (PUP-2931) Puppet CA sometimes resets certificate serial counter

[Mihkel Ader (JIRA)]

Title: Message Title

Mihkel Ader commented on an issue   Re: Puppet CA sometimes resets certificate serial counter Looking at the Puppet source code, it is pretty obvious why this happens. The serial file is opened using exclusive_open(), which uses flock, which does not work reliably on NFS. And later on the serial file is truncated, rewound and then rewritten, leaving a window where another process can read the serial file as empty and defaults to "1" as the next serial. Suggestions: 1. Use a more robust locking mechanism 2. Perform some sanity tests before defaulting to "1" as the next serial Add Comment   Puppet / PUP-2931 Puppet CA sometimes resets certificate serial counter We are running our Puppet masters on CentOS 6 with Passenger and stock Apache. Puppet CA's data files reside on NFS storage. Autosigning is turned on. Sometimes the serials of issued client certificates reset to 0x0001 with serious consequences - when someone revokes the duplicate 0x0001 client's certificate, the CA revokes its own cert too. Revoking ... This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.