Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a puppet host which has been pulling data from a remote puppetmaster, and now I want to turn this host into a puppetmaster. The host (as puppet agent) had already been configured and SSL certificates exchanged.

Now there is a new puppetmaster (on the same host) and I'm getting nowhere in setting it up. I've already configured the puppet.conf to point to the new server (the same host, but using the DNS name) but haven't configured fileserver.conf yet. The puppetmaster uses passenger and Apache.

The system is Ubuntu Lucid Lynx with Puppet 2.6.3 and Attempting to start the puppetmaster gives this response:

# service puppetmaster start
 * Starting puppet master
Could not prepare for execution: Retrieved certificate does not match private key; please remove certificate from server and regenerate it with the current key!

The configuration of puppet-passenger from the package gives this error:

# dpkg --configure puppetmaster-passenger
Setting up puppetmaster-passenger (2.6.3-0ubuntu1~lucid1) ...
Module ssl already enabled
Site puppetmaster already enabled
 * Restarting web server apache2
Syntax error on line 16 of /etc/apache2/sites-enabled/puppetmaster:
SSLCARevocationFile: file '/var/lib/puppet/ssl/ca/ca_crl.pem' does not exist or is empty!
invoke-rc.d: initscript apache2, action "restart" failed.
dpkg: error processing puppetmaster-passenger (--configure):
 subprocess installed post-installation script returned error exit status 1
Errors were encountered while processing:

I took a look in /var/lib/puppet/ssl but don't know where to begin - which certificates to remove or change, and which to leave alone. I didn't see any description of the SSL certificates. I don't see how to make /var/lib/puppet/ssl/ca/ca_crl.pem.

This process is part of setting up a dual puppetmaster configuration. Both would be active and represent the same data in two different areas (connected by a link considered "expensive"). Thus, both puppetmasters would have the same information (copied by rsync perhaps) and serving as puppetmaster to the hosts on their side of the "expensive" link, exchanging data infrequently or on demand.

I found this thread in puppet-users but it doesn't describe how to set things up and doesn't describe which SSL certs are which.

ADDED More information: running puppet master gives this information:

# puppet master
Could not prepare for execution: Retrieved certificate does not match private key; please remove certificate from server and regenerate it with the current key

If only I know where that certificate was. I feel certain that the old server configuration is interfering with the new installation but don't know how to remove the configuration.

share|improve this question
up vote 1 down vote accepted

I don't want to detract from anyone's possible answers - perhaps there is a cleaner way to achieve my goals.

Here is what I did: I removed everything in /var/lib/puppet:

cd /var/lib/puppet
rm -rf *

Since I was using a package manager, I looked for files owned by any package in that directory - and there were none. For Debian and dpkg, that is done this way:

dpkg -S * */* */*/*

Since no packages were found that owned these files, this suggested that the files were created on the fly, and since /var/lib/puppet was owned by a package (puppet-common) I left the empty directory in place.

Then I ran puppetmaster (actually a mistake since passenger is to be used) and the appropriate files were all recreated. After stopping puppetmaster, configuring passenger, and configuring /etc/default/puppetmaster and "restarting" puppetmaster (which failed quietly) - everything seemed to be good again.

Running puppet agent against the server pulled down the appropriate certs and made everything nice.

share|improve this answer
That seems quite heavy-handed. Since it was a certificate issue, I think removing /var/lib/puppet/ssl would've been enough. Or maybe just reading Puppet SSL explained – ptman Apr 5 '11 at 17:22
Seems right to me. Thanks for the valuable link! – Mei Oct 31 '11 at 15:07

If you don't care about keeping certifications for audit or other purposes it's perfectly acceptable to remove the /var/lib/puppet/ssl directory as puppet will recreate everything it needs.

If you need to maintain and want to switch, you need to delve into the world of pki and resign certs redeploy public certs etc. In your case removing just the cacert for your old puppetmaster should be sufficient to pull down the new one when you talk to the new server.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.