Re: [Puppet Users] Re: PuppetDB SSL error (while trying to reach the dashboard)

Deepak Giridharagopal
Tue, 25 Sep 2012 16:56:21 -0000

On Tue, Sep 25, 2012 at 06:44:03AM -0700, SirHopcount
<adrianvandongen@gmail.com> wrote:
>Hi Chris
>
>Sorry for the late response but I wanted to check some things first before
>responding. I made a new Puppetmaster and used this to install a new
>PuppetDB server. I successfully connected them together, I can do a
>successful puppet run on the PuppetDB node itself. When i check the
>puppetdb.log I can see the run:
>
>2012-09-25 14:56:59,434 INFO  [command-proc-74] [puppetdb.command]
>[e1ef3a0e-e5ed-4cc6-a49e-2c9dd3caef7e] [replace facts]
>mgmt-puppetdb-01.edu.local
>2012-09-25 14:57:03,787 INFO  [command-proc-74] [puppetdb.command]
>[6f07e5ca-d254-4186-a900-c5706d41e25c] [replace catalog]
>mgmt-puppetdb-01.edu.local
>2012-09-25 15:08:57,233 INFO  [command-proc-74] [puppetdb.command]
>[b0cd223f-dc63-470f-a7ff-2702720f58c2] [replace facts]
>mgmt-puppetdb-01.edu.local
>2012-09-25 15:08:58,736 INFO  [command-proc-74] [puppetdb.command]
>[bd776140-7c16-423c-8244-ff620346dbce] [replace catalog]
>mgmt-puppetdb-01.edu.local
>
>But when I try and reach the dashboard from the browser I get the same
>error as before:
>
>2012-09-25 15:18:20,934 WARN  [qtp1248545328-67] [io.nio]
>javax.net.ssl.SSLHandshakeException: null cert chain
>2012-09-25 15:19:54,544 WARN  [qtp1248545328-63] [io.nio]
>javax.net.ssl.SSLHandshakeException: null cert chain

You''re pointing your browser at puppetdb''s HTTPS port (8081),
but that
port is locked-down in terms of security; it demands a client SSL
certificate when making the connection. Because your browser doesn''t
supply one, the connection is terminated by the daemon.

Here''s the relevant section of the docs:

http://docs.puppetlabs.com/puppetdb/1/maintain_and_tune.html#monitor-the-performance-dashboard

You''ll want to connect to port 8080 instead. That''s the
default
plain-text HTTP port, which will work fine in your browser. By
default, though, puppetdb binds that port to localhost instead of all
interfaces. So you''ve got a few options:

1) hit the dashboard using a browser on the same host running
    puppetdb. that''s not always possible/practical, though.

2) use an ssh tunnel to proxy a local port to port 8080 on the
    puppetdb server: "ssh -NL 8080:localhost:8080
    your.puppetdb.host". Then point your browser at
    http://localhost:8080.

3) as the docs above mention, configure puppetdb to bind the plaintext
    socket to something other than localhost (like 0.0.0.0). Then you
    can just connect to port 8080 directly from your browser.

4) Theoretically, you could use "puppet cert generate" to make a new
    cert for your browser, and configure your browser to use that
    client certificate when trying to access the dashboard. i confess
    to never having tried this, though, as I find client certificates
    in browsers a serious PITA to configure. :P

I believe the vast majority of people use either #2 or #3.

deepak

--
Deepak Giridharagopal / Puppet Labs