[Puppet Users] Re: GRRR... cert issues

Jeff Leggett
Sat, 07 Jun 2008 08:02:14 -0000

NOw this is weird:  I had to add the --confdir to the puppetca cmd
line:

[jleggett@lxp6d4m3 requests]$ puppetca --sign lxp6d15m3.etrade.com --
confdir /opt/etrade/p6/puppet/
Signed lxp6d15m3.etrade.com
[jleggett@lxp6d4m3 requests]$


On Jun 7, 3:17 am, Jeff Leggett <jeffrey.legg...@etrade.com>
wrote:
> [jleggett@lxp6d4m3 ~]$ puppetca --clean lxp6d15m3.etrade.com
> Removing /etrade/home/jleggett/.puppet/ssl/ca/signed/
> lxp6d15m3.etrade.com.pem
> Removing /etrade/home/jleggett/.puppet/ssl/private_keys/
> lxp6d15m3.etrade.com.pem
> Removing /etrade/home/jleggett/.puppet/ssl/certs/
> lxp6d15m3.etrade.com.pem
> [jleggett@lxp6d4m3 ~]$ puppetca --sign lxp6d15m3.etrade.com
> No certificates to sign
> [jleggett@lxp6d4m3 ~]$
>
> ?
>
> On Jun 7, 2:30 am, Luke Kanies <l...@madstop.com> wrote:
>
> > Run ''puppetca --sign <hostname>'', or
''puppetca --clean <hostname>'', on
> > the server.
>
> > You''ve got an old certificate request on the server and you
need to
> > sign it.
>
> > On Jun 6, 2008, at 10:46 PM, Jeff Leggett wrote:
>
> > > anyone?   Am I being stupid and just missing something obvious?
>
> > > On Jun 6, 2:37 pm, Jeff Leggett
<jeffrey.legg...@etrade.com> wrote:
> > >> Don''t know if this helps but I see:
>
> > >> Jun  6 14:33:51 lxp6d4m3 puppetmasterd[27011]: Allowing
> > >> unauthenticated client
lxp6d15m3.etrade.com(::ffff:10.50.52.24)
> > >> access
> > >> to puppetca.getcert
> > >> Jun  6 14:33:51 lxp6d4m3 puppetmasterd[27011]: Not replacing
existing
> > >> request from lxp6d15m3.etrade.com
>
> > >> over and over in the log now too.
>
> > >> On Jun 6, 2:20 pm, Jeff Leggett
<jeffrey.legg...@etrade.com> wrote:
>
> > >>> I don''t know why I am having such problems...
Anyway... I added a
> > >>> new
> > >>> node to the mix... this being the first node
that''s not also the
> > >>> puppetmaster.  I see this in the log:
>
> > >>> Jun  6 14:15:22 lxp6d4m3 puppetmasterd[26987]: Listening
on port
> > >>> 8140
> > >>> Jun  6 14:15:22 lxp6d4m3 puppetmasterd[27011]: Reopening
log files
> > >>> Jun  6 14:15:22 lxp6d4m3 puppetmasterd[27011]: Starting
Puppet
> > >>> server
> > >>> version 0.24.4
> > >>> Jun  6 14:15:50 lxp6d4m3 puppetmasterd[27011]: Allowing
> > >>> unauthenticated client
lxp6d15m3.etrade.com(::ffff:10.50.52.24)
> > >>> access
> > >>> to puppetca.getcert
> > >>> Jun  6 14:15:50 lxp6d4m3 puppetmasterd[27011]: Host
> > >>> lxp6d15m3.etrade.com has a waiting certificate request
>
> > >>> So I go over to the puppetmaster and issue:
>
> > >>> [jleggett@lxp6d4m3 puppet]$ puppetca --list
> > >>> No certificates to sign
> > >>> [jleggett@lxp6d4m3 puppet]$ sudo puppetca --list
> > >>> No certificates to sign
> > >>> [jleggett@lxp6d4m3 puppet]$ sudo puppetca --sign
> > >>> lxp6d15m3.etrade.com
> > >>> No certificates to sign
> > >>> [jleggett@lxp6d4m3 puppet]$
>
> > >>> WTF?!
>
> > >>> So I stop the puppetmaster daemon, and the client and
move the ssl
> > >>> directory to a new name, then restart the puppetmaster as
per the
> > >>> directions here:
 http://reductivelabs.com/trac/puppet/wiki/RegenerateSSL
>
> > >>> Still no go?  What am I doing wrong?
>
> > --
> > It has recently been discovered that research causes cancer in
> > labratory rats.
> > ---------------------------------------------------------------------
> > Luke Kanies |http://reductivelabs.com|http://madstop.com