Jira (PUP-1271) puppet ca list --all fails with "Error: The certificate retrieved from the master does not match the agent's private key."

[Bram Mertens (JIRA)]

Title: Message Title

Bram Mertens commented on an issue   Re: puppet ca list --all fails with "Error: The certificate retrieved from the master does not match the agent's private key." I can reproduce this issue on RHEL6 using the puppetlabs version. Time and master and agent is synchronized, versions match: [mertensb@testpuppetmaster ~]$ rpm -q puppet puppet-master ruby openssl puppet-3.5.0-1.el6.noarch package puppet-master is not installed ruby-1.8.7.352-10.el6_4.x86_64 openssl-1.0.1e-16.el6_5.14.x86_64 [mertensb@buildsrv ~]$ rpm -q puppet puppet-master ruby openssl puppet-3.5.0-1.el6.noarch package puppet-master is not installed ruby-1.8.7.352-13.el6.x86_64 openssl-1.0.1e-16.el6_5.15.x86_64 On the agent: [mertensb@buildsrv ~]$ sudo puppet ca list Error: The certificate retrieved from the master does not match the agent's private k Certificate fingerprint: 44:20:F8:D7:0C:D2:95:9C:E0:5B:CD:F0:EB:1C:8B:F0:E8:34:2A:98: To fix this, remove the certificate from both the master and the agent and then start On the master: puppet cert clean buildsrv.mle.mazdaeur.com On the agent: rm -f /var/lib/puppet/ssl/certs/buildsrv.mle.mazdaeur.com.pem puppet agent -t Error: Try 'puppet help ca list' for usage The server shows no outstanding certificates, i.e. sudo puppet cert list returns nothing and sudo puppet cert list --all returns only already signed agents (lines starting with +). I tried the instructions reported without success: [mertensb@testpuppetmaster ~]$ sudo puppet cert clean buildsrv.mle.mazdaeur.com Error: Could not find a serial number for buildsrv.mle.mazdaeur.com I have manually copied /var/lib/puppet/ssl/certs/ca.pem from the server to the agent but that did not resolve the issue. I solved it on this agent by removing everything in /var/lib/puppet/ssl and running another test run. Add Comment   Puppet / PUP-1271 puppet ca list --all fails with "Error: The certificate retrieved from the master does not match the agent's private key."  On my puppetmaster server (using Apache, PhusionPassenger, puppet 3.1.0-1 on Debian Squeeze), attempting to run "puppet ca list --all" fails with:     Error: The certificate retrieved from the master does not match the agent's private key.     Certificate fingerprint: [[REDACTED]]     To fix this, remove the certificate from both the master and the ... This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.