Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have build an testlap for puppet, but it doesnt work. I start the Puppet Agent on the Node and he waits for the Certificate.

root:~# puppet agent --server xxxx --waitforcert 60 --test
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session

Now on the Server, it comes nothing.

root:~# puppet cert --list                                                                                                        
root:~#

Yes, i doenst know why. But in the masterhttpd log:

root:~# tail /var/log/puppet/masterhttp.log
[2012-01-06 09:19:17] xxx - - [06/Jan/2012:09:19:17 CET] "GET /production/certificate/xx HTTP/1.1" 404 30
[2012-01-06 09:19:17] - -> /production/certificate/pgw
[2012-01-06 09:19:47] xxx - - [06/Jan/2012:09:19:47 CET] "GET /production/certificate/xx HTTP/1.1" 404 30
[2012-01-06 09:19:47] - -> /production/certificate/pgw
[2012-01-06 09:19:47] xxx - - [06/Jan/2012:09:19:47 CET] "GET /production/certificate/xx HTTP/1.1" 404 30
[2012-01-06 09:19:47] - -> /production/certificate/pgw
[2012-01-06 09:19:47] xxx - - [06/Jan/2012:09:19:47 CET] "GET /production/certificate/xx HTTP/1.1" 404 30
[2012-01-06 09:19:47] - -> /production/certificate/pgw

404 for it? I dont know how can I fix it. I am very happy for an help!

share|improve this question
    
once you run the puppet for te first time with waitforcert enabled then try running it again without waitforcert. Chances are that your cert is already signed and that is why puppet cert --list is empty. – Aditya Patawari Jan 6 '12 at 8:53
    
root:~# puppetca revoke --list 12-01-06 10:25 err: Could not call list: Could not find a certificate for revoke looks like not an signed cert :( – Dennis Wisnia Jan 6 '12 at 9:25

I recommend you start the puppet agent as

$ puppet agent --server=xxxx --test --debug

this command will give you more details why it is failing. Also, you may need tgo allow more time for it to complete.

You can also try to remove the certificate from sides if any (on master and agent respectively)

puppet --cert --clean your_machine_name

rm -rf /etc/puppet/ssl
share|improve this answer
    
"debug" delivers me no one new news. He waits for the certifcate and runs in the timeout. I think it is a Problem on the Server-side. – Dennis Wisnia Jan 6 '12 at 9:24

I ran into very similar problems when I first started with Puppet. The --server option was not being respected.

Try adding an entry to your HOSTS file with the name of 'puppet' and the IP of your master box.

If that works the following syntax works well (at least for version 2.7.5)

[main]
logdir = /var/log/puppet
rundir = /var/run/puppet
ssldir = $vardir/ssl
server = puppetmaster.yourdomain.org
pluginsync = true

[agent]
classfile = $vardir/classes.txt
localconfig = $vardir/localconfig
server = puppetmaster.yourdomain.org
listen = true
share|improve this answer

Looks like you verified that the agent is getting to the master. Good first step.

Next, as others have suggested, verify that the certificate wasn't signed and that you just didn't miss it:

sudo puppet cert --list --all

If you don't see it there, I'd clean everything up and start over.

First, confirm that the date and time on both servers are in sync. You could force an NTP sync with something like ntpd -q -g, depending on your distro and NTP client.

Then, run a clean on the puppet master:

sudo puppet cert clean <agent hostname>

On the agent, clean up all your SSL files:

sudo rm -rf /var/puppet/ssl /var/lib/puppet/ssl/ /var/puppet/ssl 

Finally, run a test:

sudo puppet agent --debug --test --server <master hostname>

Hopefully, if this doesn't address the issue, this should yield you some clues as to where to look.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.