[Puppet Users] Re: GRRR... cert issues

Jeff Leggett
Sat, 07 Jun 2008 07:17:49 -0000

[jleggett@lxp6d4m3 ~]$ puppetca --clean lxp6d15m3.etrade.com
Removing /etrade/home/jleggett/.puppet/ssl/ca/signed/
lxp6d15m3.etrade.com.pem
Removing /etrade/home/jleggett/.puppet/ssl/private_keys/
lxp6d15m3.etrade.com.pem
Removing /etrade/home/jleggett/.puppet/ssl/certs/
lxp6d15m3.etrade.com.pem
[jleggett@lxp6d4m3 ~]$ puppetca --sign lxp6d15m3.etrade.com
No certificates to sign
[jleggett@lxp6d4m3 ~]$

?

On Jun 7, 2:30 am, Luke Kanies <l...@madstop.com>
wrote:
> Run ''puppetca --sign <hostname>'', or
''puppetca --clean <hostname>'', on
> the server.
>
> You''ve got an old certificate request on the server and you need
to
> sign it.
>
> On Jun 6, 2008, at 10:46 PM, Jeff Leggett wrote:
>
>
>
>
>
> > anyone?   Am I being stupid and just missing something obvious?
>
> > On Jun 6, 2:37 pm, Jeff Leggett <jeffrey.legg...@etrade.com>
wrote:
> >> Don''t know if this helps but I see:
>
> >> Jun  6 14:33:51 lxp6d4m3 puppetmasterd[27011]: Allowing
> >> unauthenticated client lxp6d15m3.etrade.com(::ffff:10.50.52.24)
> >> access
> >> to puppetca.getcert
> >> Jun  6 14:33:51 lxp6d4m3 puppetmasterd[27011]: Not replacing
existing
> >> request from lxp6d15m3.etrade.com
>
> >> over and over in the log now too.
>
> >> On Jun 6, 2:20 pm, Jeff Leggett <jeffrey.legg...@etrade.com>
wrote:
>
> >>> I don''t know why I am having such problems...
Anyway... I added a
> >>> new
> >>> node to the mix... this being the first node that''s
not also the
> >>> puppetmaster.  I see this in the log:
>
> >>> Jun  6 14:15:22 lxp6d4m3 puppetmasterd[26987]: Listening on
port
> >>> 8140
> >>> Jun  6 14:15:22 lxp6d4m3 puppetmasterd[27011]: Reopening log
files
> >>> Jun  6 14:15:22 lxp6d4m3 puppetmasterd[27011]: Starting Puppet

> >>> server
> >>> version 0.24.4
> >>> Jun  6 14:15:50 lxp6d4m3 puppetmasterd[27011]: Allowing
> >>> unauthenticated client
lxp6d15m3.etrade.com(::ffff:10.50.52.24)
> >>> access
> >>> to puppetca.getcert
> >>> Jun  6 14:15:50 lxp6d4m3 puppetmasterd[27011]: Host
> >>> lxp6d15m3.etrade.com has a waiting certificate request
>
> >>> So I go over to the puppetmaster and issue:
>
> >>> [jleggett@lxp6d4m3 puppet]$ puppetca --list
> >>> No certificates to sign
> >>> [jleggett@lxp6d4m3 puppet]$ sudo puppetca --list
> >>> No certificates to sign
> >>> [jleggett@lxp6d4m3 puppet]$ sudo puppetca --sign
> >>> lxp6d15m3.etrade.com
> >>> No certificates to sign
> >>> [jleggett@lxp6d4m3 puppet]$
>
> >>> WTF?!
>
> >>> So I stop the puppetmaster daemon, and the client and move the
ssl
> >>> directory to a new name, then restart the puppetmaster as per
the
> >>> directions here:
 http://reductivelabs.com/trac/puppet/wiki/RegenerateSSL
>
> >>> Still no go?  What am I doing wrong?
>
> --
> It has recently been discovered that research causes cancer in
> labratory rats.
> ---------------------------------------------------------------------
> Luke Kanies |http://reductivelabs.com|http://madstop.com