Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of our machines was recently put behind an SSL proxy and since then I can't connect to puppet with "Could not evaluate: certificate verify failed."

I have checked that the dates match, regenerated the certificates but to no avail.

Debugging the verification with "openssl s_client -showcerts -connect puppetmaster:puppetmasterport" shows "Verify return code: 0 (ok)"

Initially the Proxy SSL Certificate was not recognized with a "Verify return code: 20 (unable to get local issuer certificate)" problem which was then fixed with the answer in the question: Adding root certificate to CentOS 5

share|improve this question
check also the time set on the master and your agent. – Sebastien Varrette Oct 12 '12 at 13:50
Thanks for the addition, I should've specified I checked the date AND time :) – Onitlikesonic Oct 15 '12 at 11:53
up vote 1 down vote accepted

This seems to have solved my problem:

you need to add the top level ca pub key to it to /var/lib/puppet/ssl/certs/ca.pem


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.