Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up Puppetdb with SSL and having issues with certificates.

I'm using Nginx as an SSL proxy for Puppet, so my CA is managed by a mongrel server on this Nginx proxy machine.

If I generate a certificate for my Puppetdb URI using the CA on the Nginx machine, I'm able to setup the Puppetdb using the puppetlabs-puppetdb module (since the Puppet agent uses the proxy's CA), but then the Puppetmaster cannot connect to it, because it has its own CA certificate which is generates itself.

If I generate a certificate for the Puppetdb URI using one of the Puppetmasters, I cannot deploy the Puppetdb using the puppetlabs-puppetdb module since the Puppet agent doesn't use the same CA certificate.

What could I do to reconcile all this? Can I full turn off SSL on my puppetmasters (since SSL is managed by the Nginx proxy) and have them use the proxy's CA to connect to the Puppetdb?

share|improve this question
up vote 1 down vote accepted

I was using a wrong setup for my puppetmasters, namely, letting them create their own CA in a separate directory. This link cleared it up. I now:

  • Use the same directory in agent and master mode (in my case, the standard /var/lib/puppet/ssl directory). This ensures that it uses the same CA for both modes;
  • Use ca=false on the puppetmaster (section master) so the puppetmaster won't complain about using another CA than his own;
  • Stop specifying certname= for puppetmasters and let them use the machine's name as done in agent mode.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.