Puppet users - Aug 2013 - Puppet ssl errors " SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed"

Hi all, I am trying to setup puppet master and puppetdb on same node using 
puppetdb module.

When I try to run puppet agent -t, I see following erorr

notice: Unable to connect to puppetdb server 
(ip-10-172-161-25.us-west-1.compute.internal:8081): SSL_connect returned=1 
errno=0 state=SSLv3 read server certificate B: certificate verify failed
notice: Failed to connect to puppetdb; sleeping 2 seconds before retry


[root@ip-10-172-161-25 modules]# puppet cert --list --all
+ "ip-10-172-161-25.us-west-1.compute.internal" 
(66:37:02:AB:98:C5:CD:28:1C:D3:68:53:13:CC:A1:E5)
+ "ip-10-196-99-56.us-west-1.compute.internal"  
(99:C9:7C:A1:1A:FD:3C:27:85:76:C7:5A:6A:D5:F9:79)
+ "puppettest.eng.com"                         
(17:4A:B9:D1:48:F2:82:73:7D:7F:1D:55:E4:A1:A6:A0) (alt names: 
"DNS:ip-10-172-161-25.us-west-1.compute.internal",
"DNS:puppet",
"DNS:puppettest.eng.com")


[root@ip-10-172-161-25 modules]# cat /etc/puppet/puppet.conf 
[main]
    # The Puppet log directory.
    # The default value is ''$vardir/log''.
    logdir = /var/log/puppet

    # Where Puppet PID files are kept.
    # The default value is ''$vardir/run''.
    rundir = /var/run/puppet

    # Where SSL certificates are kept.
    # The default value is ''$confdir/ssl''.
    ssldir = $vardir/ssl
    server = puppettest.eng.com

[agent]
    # The file in which puppetd stores a list of the classes
    # associated with the retrieved configuratiion.  Can be loaded in
    # the separate ``puppet`` executable using the ``--loadclasses``
    # option.
    # The default value is ''$confdir/classes.txt''.
    classfile = $vardir/classes.txt

    # Where puppetd caches the local configuration.  An
    # extension indicating the cache format is added automatically.
    # The default value is ''$confdir/localconfig''.
    localconfig = $vardir/localconfig

[master]

    certname=puppettest.eng.com
    dns_alt_names = 
ip-10-172-161-25.us-west-1.compute.internal,puppettest.eng.com,puppet



Puppetdb.cof
=========
[root@ip-10-172-161-25 modules]# cat /etc/puppet/puppetdb.conf 
[main]
server = ip-10-172-161-25.us-west-1.compute.internal
#server = puppettest.eng.com
port = 8081



jetty.in
=====
[jetty]
# Hostname or IP address to listen for clear-text HTTP.  Default is 
localhost
# host = <host>
#host = localhost
host = localhost

# Port to listen on for clear-text HTTP.
port = 8080


# The following are SSL specific settings. They can be configured
# automatically with the tool puppetdb-ssl-setup, which is normally
# ran during package installation.

# The host or IP address to listen on for HTTPS connections
#ssl-host = ip-10-172-161-25.us-west-1.compute.internal
ssl-host = ip-10-172-161-25.us-west-1.compute.internal

# The port to listen on for HTTPS connections
ssl-port = 8081

# Private key path
ssl-key = /etc/puppetdb/ssl/private.pem

# Public certificate path
ssl-cert = /etc/puppetdb/ssl/public.pem

# Certificate authority path
ssl-ca-cert = /etc/puppetdb/ssl/ca.pem

certificate-whitelist = /etc/puppetdb/whitelist.txt



whitelist.txt
========[root@ip-10-172-161-25 modules]# cat /etc/puppetdb/whitelist.txt
ip-10-172-161-25.us-west-1.compute.internal
puppettest.eng.com
localhost


[root@ip-10-172-161-25 modules]# rpm -qa | grep -i puppet
puppet-server-2.7.22-1.0.amzn1.x86_64
puppetlabs-release-5-7.noarch
puppetdb-terminus-1.4.0-1.el5.noarch
puppet-2.7.22-1.0.amzn1.x86_64
puppetdb-1.4.0-1.el5.noarch
[root@ip-10-172-161-25 modules]# rpm -qa | grep -i ruby
ruby-libs-1.8.7.374-1.0.amzn1.x86_64
ruby-1.8.7.374-1.0.amzn1.x86_64
ruby-augeas-0.4.1-1.3.amzn1.x86_64
[root@ip-10-172-161-25 modules]# 


I tired multiple times revoke master cert and created new, no luck

-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscribe@googlegroups.com.
To post to this group, send email to puppet-users@googlegroups.com.
Visit this group at http://groups.google.com/group/puppet-users.
For more options, visit https://groups.google.com/groups/opt_out.

> I tired multiple times revoke master cert and created new, no luck
Can you run puppetdb-ssl-setup -f ... restart puppetdb and show us the results?

ken.

-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscribe@googlegroups.com.
To post to this group, send email to puppet-users@googlegroups.com.
Visit this group at http://groups.google.com/group/puppet-users.
For more options, visit https://groups.google.com/groups/opt_out.

>
> Can you run puppetdb-ssl-setup -f ... restart puppetdb and show us the 
> results? 
>
> ken. 
>
[root@ip-10-172-161-25 modules]# puppetdb-ssl-setup -f
PEM files in /etc/puppetdb/ssl already exists, checking integrity.
Warning: /etc/puppetdb/ssl/private.pem does not match the file used by 
Puppet (/var/lib/puppet/ssl/private_keys/puppettest.eng.com.pem)
Warning: /etc/puppetdb/ssl/public.pem does not match the file used by 
Puppet (/var/lib/puppet/ssl/certs/puppettest.eng.com.pem)
Overwriting existing PEM files due to -f flag
Copying files: /var/lib/puppet/ssl/certs/ca.pem, 
/var/lib/puppet/ssl/private_keys/puppettest.eng.com.pem and 
/var/lib/puppet/ssl/certs/puppettest.eng.com.pem to /etc/puppetdb/ssl
Setting ssl-host in /etc/puppetdb/conf.d/jetty.ini already correct.
Setting ssl-port in /etc/puppetdb/conf.d/jetty.ini already correct.
Setting ssl-key in /etc/puppetdb/conf.d/jetty.ini already correct.
Setting ssl-cert in /etc/puppetdb/conf.d/jetty.ini already correct.
Setting ssl-ca-cert in /etc/puppetdb/conf.d/jetty.ini already correct. 



What does this mean ? 

Warning: /etc/puppetdb/ssl/private.pem does not match the file used by 
Puppet (/var/lib/puppet/ssl/private_keys/puppettest.eng.com.pem)
Warning: /etc/puppetdb/ssl/public.pem does not match the file used by 
Puppet (/var/lib/puppet/ssl/certs/puppettest.eng.com.pem)

Both should match ? 

-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscribe@googlegroups.com.
To post to this group, send email to puppet-users@googlegroups.com.
Visit this group at http://groups.google.com/group/puppet-users.
For more options, visit https://groups.google.com/groups/opt_out.

On Monday, August 26, 2013 4:39:20 PM UTC-7, Ken Barber
wrote:
>
> > I tired multiple times revoke master cert and created new, no luck 
>
> Can you run puppetdb-ssl-setup -f ... restart puppetdb and show us the 
> results? 
>
> ken. 
>
Ken - It worked for me, 

I am new to puppet, can you please explain what happened in background ? 

Appreacitate your time. 

-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscribe@googlegroups.com.
To post to this group, send email to puppet-users@googlegroups.com.
Visit this group at http://groups.google.com/group/puppet-users.
For more options, visit https://groups.google.com/groups/opt_out.

> What does this mean ?
>
> Warning: /etc/puppetdb/ssl/private.pem does not match the file used by
> Puppet (/var/lib/puppet/ssl/private_keys/puppettest.eng.com.pem)
> Warning: /etc/puppetdb/ssl/public.pem does not match the file used by
Puppet
> (/var/lib/puppet/ssl/certs/puppettest.eng.com.pem)
>
> Both should match ?
So basically yes, they should match - puppetdb-ssl-setup uses the
certificates from the agent/master more for simplicity sake, but
whatever cert you choose to use - it must be signed by the same CA
that the client''s certificate (in this case the puppet master) was
signed with.

In this case I can only presume that it was using old certificates
that were signed by an old CA certificate - and since you had
mentioned you have renewed something in your certificates dir that
caused an issue. Its just hard to articulate to users that they must
run ''puppetdb-ssl-setup'' when this happens (although we do
document it
here:
http://docs.puppetlabs.com/puppetdb/latest/maintain_and_tune.html#redo-ssl-setup-after-changing-certificates).

In the future we are hoping that we can just point the configuration
in jetty.ini directly at the Puppet certs without this need for
copying certs, but currently the directories and private key in
particular are locked down ... this can be fixed with a change to
puppet.conf, but its something I''m wary of doing with
''puppetdb-ssl-setup'' since that file might be managed by
something
else ... and clobbering other files like that is impolite. We are
going to revisit the issue in the future since its such a PITA for
people (and for me also), but ideas welcome :-).

ken.

-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to puppet-users+unsubscribe@googlegroups.com.
To post to this group, send email to puppet-users@googlegroups.com.
Visit this group at http://groups.google.com/group/puppet-users.
For more options, visit https://groups.google.com/groups/opt_out.