Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My puppet master server had a hardware failure, and I have restored to another box. However this box has different hardware and hostname.

If I restore the existing /etc/puppet directory to the new server, the puppetmaster will not start with the following error;

# puppetmasterd --debug --verbose Could not prepare for execution: Retrieved certificate does not match private key; please remove certificate from server and regenerate it with the current key

So what steps do I need to take to allow the new puppetmaster to start, and to generate a new puppetmaster certificate using the old ca..

Also will the puppet clients actually report in to a different puppet server using a server certificate that has been generated with the old CA?

share|improve this question
up vote 5 down vote accepted

The puppetmaster stores all of the certificates, keys, and ca information in the folder /var/lib/puppet/ssl. From my testing you should be able to:

  1. stop puppetmasterd
  2. delete the file /var/lib/puppet/ssl/certs/hostname.pem
  3. start puppetmasterd

This should generate a new server side ssl certificate using the old private key and CA, as well as preserve the existing client certificates that have already been signed.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.