[Puppet Users] Re: GRRR... cert issues

David Schmitt
Sun, 08 Jun 2008 08:48:47 -0000

Jeff Leggett schrieb:
> NOw this is weird:  I had to add the --confdir to the puppetca cmd
> line:
>
> [jleggett@lxp6d4m3 requests]$ puppetca --sign lxp6d15m3.etrade.com --
> confdir /opt/etrade/p6/puppet/
> Signed lxp6d15m3.etrade.com
> [jleggett@lxp6d4m3 requests]$
>
>
> On Jun 7, 3:17 am, Jeff Leggett <jeffrey.legg...@etrade.com> wrote:
>> [jleggett@lxp6d4m3 ~]$ puppetca --clean lxp6d15m3.etrade.com
>> Removing /etrade/home/jleggett/.puppet/ssl/ca/signed/
>> lxp6d15m3.etrade.com.pem
>> Removing /etrade/home/jleggett/.puppet/ssl/private_keys/
>> lxp6d15m3.etrade.com.pem
>> Removing /etrade/home/jleggett/.puppet/ssl/certs/
>> lxp6d15m3.etrade.com.pem
>> [jleggett@lxp6d4m3 ~]$ puppetca --sign lxp6d15m3.etrade.com
>> No certificates to sign
>> [jleggett@lxp6d4m3 ~]$


Yeah all the puppet tools behave differently when run as root
(System-Mode) vs. when run as User (User-Mode). I''m quite amazed that
your jleggett user has sufficient privileges to write into puppet''s
$ssldir.


Regards, DavidS


>> ?
>>
>> On Jun 7, 2:30 am, Luke Kanies <l...@madstop.com> wrote:
>>
>>> Run ''puppetca --sign <hostname>'', or
''puppetca --clean <hostname>'', on
>>> the server.
>>> You''ve got an old certificate request on the server and
you need to
>>> sign it.
>>> On Jun 6, 2008, at 10:46 PM, Jeff Leggett wrote:
>>>> anyone?   Am I being stupid and just missing something obvious?
>>>> On Jun 6, 2:37 pm, Jeff Leggett
<jeffrey.legg...@etrade.com> wrote:
>>>>> Don''t know if this helps but I see:
>>>>> Jun  6 14:33:51 lxp6d4m3 puppetmasterd[27011]: Allowing
>>>>> unauthenticated client
lxp6d15m3.etrade.com(::ffff:10.50.52.24)
>>>>> access
>>>>> to puppetca.getcert
>>>>> Jun  6 14:33:51 lxp6d4m3 puppetmasterd[27011]: Not
replacing existing
>>>>> request from lxp6d15m3.etrade.com
>>>>> over and over in the log now too.
>>>>> On Jun 6, 2:20 pm, Jeff Leggett
<jeffrey.legg...@etrade.com> wrote:
>>>>>> I don''t know why I am having such problems...
Anyway... I added a
>>>>>> new
>>>>>> node to the mix... this being the first node
that''s not also the
>>>>>> puppetmaster.  I see this in the log:
>>>>>> Jun  6 14:15:22 lxp6d4m3 puppetmasterd[26987]:
Listening on port
>>>>>> 8140
>>>>>> Jun  6 14:15:22 lxp6d4m3 puppetmasterd[27011]:
Reopening log files
>>>>>> Jun  6 14:15:22 lxp6d4m3 puppetmasterd[27011]: Starting
Puppet
>>>>>> server
>>>>>> version 0.24.4
>>>>>> Jun  6 14:15:50 lxp6d4m3 puppetmasterd[27011]: Allowing
>>>>>> unauthenticated client
lxp6d15m3.etrade.com(::ffff:10.50.52.24)
>>>>>> access
>>>>>> to puppetca.getcert
>>>>>> Jun  6 14:15:50 lxp6d4m3 puppetmasterd[27011]: Host
>>>>>> lxp6d15m3.etrade.com has a waiting certificate request
>>>>>> So I go over to the puppetmaster and issue:
>>>>>> [jleggett@lxp6d4m3 puppet]$ puppetca --list
>>>>>> No certificates to sign
>>>>>> [jleggett@lxp6d4m3 puppet]$ sudo puppetca --list
>>>>>> No certificates to sign
>>>>>> [jleggett@lxp6d4m3 puppet]$ sudo puppetca --sign
>>>>>> lxp6d15m3.etrade.com
>>>>>> No certificates to sign
>>>>>> [jleggett@lxp6d4m3 puppet]$
>>>>>> WTF?!
>>>>>> So I stop the puppetmaster daemon, and the client and
move the ssl
>>>>>> directory to a new name, then restart the puppetmaster
as per the
>>>>>> directions here:
http://reductivelabs.com/trac/puppet/wiki/RegenerateSSL
>>>>>> Still no go?  What am I doing wrong?
>>> --
>>> It has recently been discovered that research causes cancer in
>>> labratory rats.
>>>
---------------------------------------------------------------------
>>> Luke Kanies |http://reductivelabs.com|http://madstop.com
> >