Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am wondering how to manually (using openssl instead of puppet ca command) create CA that would be usable by Puppet? The goal would be to script creation of such CA's to deploy them on multiple puppetmasters, instead of certificates being created on them via puppet cert command.

Any ideas on how to do it? I was only able to find something like that: but it fails to work - after creating CA and client cert and applying them to puppetmaster, it complains with:

Feb 16 09:35:20 test puppet-master[81728]: Could not prepare for execution: The certificate retrieved from the master does not match the agent's private key.
Feb 16 09:35:20 test puppet-master[81728]: Certificate fingerprint: 4F:08:AE:01:B9:14:AC:A4:EA:A7:92:D7:02:E9:34:39:1C:5F:0D:93:A0:85:1C:CF:68:E4:52:B8:25:D1:11:64
Feb 16 09:35:20 test puppet-master[81728]: To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certficate.
Feb 16 09:35:20 test puppet-master[81728]: On the master:
Feb 16 09:35:20 test puppet-master[81728]:   puppet cert clean test
Feb 16 09:35:20 test puppet-master[81728]: On the agent:
Feb 16 09:35:20 test puppet-master[81728]:   rm -f /var/puppet/ssl/certs/test.pem
Feb 16 09:35:20 test puppet-master[81728]:   puppet agent -t
share|improve this question
Thanks, but unfortunately, it only says its possible, without showing how. I addition to that, it refers to quite old version of Puppet. – SpankMe Feb 16 '13 at 8:29
@SpankMe Why not just use puppet cert generate? – Shane Madden Feb 16 '13 at 8:46
@Shane Because I would have to wrap system commands in scripts with Popen objects, validate their output by text parsing... Its much less flexible and 'kosher' than simply using openssl library, and in addition to that requires puppet installation on a server, where it shouldn't be installed - I only want to pregenerate puppet's CA and client certs there, and then distribute those to proper machines. – SpankMe Feb 16 '13 at 8:59

The agent is not using the pregenerated client certificate. It created a CSR (with a new key) instead, so the master will not trust the agent.

Make sure that the files found in

`puppet agent --configprint ssldir`/{certs,private_keys}/`puppet agent --configprint certname`

are identical to those that you pregenerated and put on your master as well. (The master should not receive a copy of the agent's private key.)

share|improve this answer

I don't know why would you ever need a script that generates certs? Once puppet generates the cert that should be good for as long as you have the client (agent). Unless you removed the client and create a new client machine with the same hostname. If you run puppet, it will complain saying that there is private key mismatch. Instead you should clean out the cert on the puppet server whenever you don't need the client (e.g. you are reinstalling OS or recreating a virtual machine) with puppet cert clean test on puppetmaster.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.