Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple puppetmasters, instead of certificates being created on them via puppet cert command.

Any ideas on how to do it? I was only able to find something like that: https://wiki.mozilla.org/ReleaseEngineering/PuppetAgain/HowTo/Set_up_a_standalone_puppetmaster but it fails to work - after creating CA and client cert and applying them to puppetmaster, it complains with:

Feb 16 09:35:20 test puppet-master[81728]: Could not prepare for execution: The certificate retrieved from the master does not match the agent's private key.
Feb 16 09:35:20 test puppet-master[81728]: Certificate fingerprint: 4F:08:AE:01:B9:14:AC:A4:EA:A7:92:D7:02:E9:34:39:1C:5F:0D:93:A0:85:1C:CF:68:E4:52:B8:25:D1:11:64
Feb 16 09:35:20 test puppet-master[81728]: To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certficate.
Feb 16 09:35:20 test puppet-master[81728]: On the master:
Feb 16 09:35:20 test puppet-master[81728]:   puppet cert clean test
Feb 16 09:35:20 test puppet-master[81728]: On the agent:
Feb 16 09:35:20 test puppet-master[81728]:   rm -f /var/puppet/ssl/certs/test.pem
Feb 16 09:35:20 test puppet-master[81728]:   puppet agent -t
share|improve this question
    
    
Thanks, but unfortunately, it only says its possible, without showing how. I addition to that, it refers to quite old version of Puppet. –  SpankMe Feb 16 '13 at 8:29
    
@SpankMe Why not just use puppet cert generate? –  Shane Madden Feb 16 '13 at 8:46
1  
@Shane Because I would have to wrap system commands in scripts with Popen objects, validate their output by text parsing... Its much less flexible and 'kosher' than simply using openssl library, and in addition to that requires puppet installation on a server, where it shouldn't be installed - I only want to pregenerate puppet's CA and client certs there, and then distribute those to proper machines. –  SpankMe Feb 16 '13 at 8:59
add comment

1 Answer 1

The agent is not using the pregenerated client certificate. It created a CSR (with a new key) instead, so the master will not trust the agent.

Make sure that the files found in

`puppet agent --configprint ssldir`/{certs,private_keys}/`puppet agent --configprint certname`

are identical to those that you pregenerated and put on your master as well. (The master should not receive a copy of the agent's private key.)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.