Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Puppetmaster server A and a server B that is a Puppet client of A. I would like to setup server B to be a Puppetmaster itself and make server C be a Puppet client of server B. (Note: all servers are Debian squeeze.)

PM A <------ PM B <------ C
      client       client

I tried, but when I try to start puppetmaster on server B I get this error:

Could not prepare for execution: The certificate retrieved from the master does not match the agent's private key.

Is this sort of chaining possible? If so, how?

share|improve this question
When you start puppet master, the first thing it does is generate a new set of certs for itself. Also, why you want to do this master-slave-subslave setup anyway? – qweet Jun 15 '12 at 17:55
I am tempted to believe that you could create two separate puppet configuration files, which specify different state/data directories. Then have one config be for your running server, and the second called by the agent process to the other server. Not exactly sure about all the details though. – Zoredache Jun 15 '12 at 18:06
"Why?" A Puppetmaster can easily be a client of itself. – Michuelnik Jul 12 '12 at 7:55
@Michuelnik, to answer why, you might want this to build a hierarchy. So image I work at a given organization and am hired to assist in the management of systems at a completely separate organization. I want to push some settings to a server under that separate organizations control, and also give them the ability perform some management internally. – Zoredache Jul 18 '12 at 18:16
@Zoredache: Perhaps I do not quite understand, but this seems to me, that you want to maintain separate puppet environments. I could imagine better tools for pushing these changes to (different?) puppet servers than puppet since you do not have to configure much but instead push your modules/manifests? I would use svn or git or rsync for this? – Michuelnik Jul 19 '12 at 5:42

In /etc/puppet.conf you need to specify the certs for server B as a server, and for server B as a client.

When starting puppetmasterd on serverB

puppetmasterd --no-daemonize --verbose --certname serverB_server

To create the client cert:

puppet cert generate <puppet master's certname> --dns_alt_names=<comma-separated list of DNS names>

then conf file


share|improve this answer
Have you actually tested this? This just seems to give me lots of certificate errors about the master not matching the agents private key. – Zoredache Jul 18 '12 at 17:55
Yes, but not from the package debian package, but from the puppet installer, Ive never had problems keeping client certs apart from its server certs. Use this model for multi master configs. – Sirch Jul 18 '12 at 22:16
I tried your suggestion but am getting the same "The certificate retrieved from the master does not match the agent's private key." errors when starting the puppetmaster daemon on server B as Zoredache seems to be getting. Be aware that I want server B to act as its clients CA. This is not the same as multi master setups. – user35042 Jul 26 '12 at 16:50

The setup that seemed to be straight forward and work on a Debian/Ubuntu host was to simply setup a separate configuration files and directory. This is for webrick, not sure what you need to do for passenger.

Create a confdir for the master mkdir -p /etc/puppetmaster/

Update the /etc/default/puppetmaster

--- a/default/puppetmaster
+++ b/default/puppetmaster
@@ -4,4 +4,4 @@

 # Startup options.

Create a puppet.conf file in /etc/puppetmaster/ for the master.

# pluginsync = true
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.