Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is what I am getting when connecting to puppetmaster using puppetd --test. I have an entry for puppetmaster in my client's /etc/hosts:

warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
Exiting; no certificate found and waitforcert is disabled

I don't know why it's happening. There's no autosign.conf in my puppetmaster. There are no pending certificates to sign. In fact, there's no certificate request already present.

share|improve this question

migrated from Aug 31 '12 at 22:53

This question came from our site for users of Linux, FreeBSD and other Un*x-like operating systems.

When you run:

puppet cert list --all

-from the master

Do you see the certificate for the agent machine listed?

Is the master defined correctly in your puppet.conf file?

Are you running Puppet Open Source or Puppet Enterprise?

Depending on the answer to that your directory locations will be different: Enterprise: /etc/puppetlabs/puppet Open Source: /etc/puppet

Once you get to the puppet directory where your manifests and modules directories are go into the ssl directory /etc/puppetlabs/puppet/ssl

You should see several directories:

Look in the certs directory. If you server is named server1 you should have a certificate file.

Look at it via cat

It should match the certificate in the same location on the agent (match mean be identical). Also, on the master you should have the same cert located in the /etc/puppetlabs/puppet/ssl/ca/signed

If any of them are off or if you want to re-authorize an agents certificates from the master run a puppet cert clean and it will revoke and remove all instances of the agents certificate from the master and you can re-request and re-sign a new one from the agent. Additionally, I would run a search after the clean to make sure that it got them all and delete any stragglers.

Let me know if any of this helps or simply cause you more frustration.

Before you run any command like: puppet cert clean etc... you can get more information with the options by adding --help as in - puppet cert --help

share|improve this answer
LinuxlyChallenged, I am using the open source version. I see some entries using puppet cert list --all, but i am not able to see the required client's request. Actually, i get the above mentioned warnings and errors everytime when i do a puppet run from that client. I have done puppet cert clean --all and tried again many times, but the error persists. – NixMan Sep 5 '12 at 8:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.