2

I installed the puppet master and agent on the same machine. When the client is started, I got the following error message.

puppet agent --server=agent.com --no-daemonize --debug



err: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed.  This is often because the time is out of sync on the server or client
Improve this question
3
  • Obvious question: is the time in sync?
    – Dennis Kaarsemaker
    Jun 1, 2013 at 9:01
  • master and client are both in same machine. So time should be synced, I guess.
    – Udara S.S Liyanage
    Jun 1, 2013 at 9:08
  • Doh, completely misread :) Can you do an x509 dump of the server cert (opssl x509 -noout -text /path/to/server.crt) and add that to your post. Next guess is that the DN in the cert doesn't match the hostname of the machine.
    – Dennis Kaarsemaker
    Jun 1, 2013 at 9:10

3 Answers 3

Reset to default
1

Try making an entry in /etc/hosts

127.0.0.1 localhost.localdomain localhost puppet

remove the --server argument to the puppet agent command.

Improve this answer
10

Find out the FQDN of your puppetmaster by issuing:

# openssl x509 -noout -subject -in /var/lib/puppet/ssl/ca/ca_crt.pem
subject= /CN=Puppet CA: host.domain.com

Compare with the output (if any) of:

# puppet cert list --all

Add an entry to your /etc/hosts file pointing the IP listening in the puppetmaster port (8140):

192.168.124.2  host.domain.com host

To find out which IP to use, you need to know the process listening, which is different if this is a standalone puppetmaster or an apache+passenger installation. You can use:

netstat -an | grep 8140.*LISTEN

Check your /etc/puppet/puppet.conf file, specifically the server= entry, which should be pointing to the FQDN described above.

Don't use localhost, unless you don't want this puppetmaster to be found.

Before starting the pupppet agent, issue:

# puppet agent --test --waitforcet 2

which instructs the agent to send a CSR to the puppetmaster CA and wait for it to be signed.

Check using

# puppet cert --list

The pending to sign CSR. Sign it:

# puppet cert sign host.domain.com

Watch puppet agent receive a compiled catalog and apply it. After that, you are ready to start the agent and add it to the startup scripts.

Improve this answer
2
  • 2
    @UdaraS.SLiyanage Please mark the answer as accepted for future reference
    – dawud
    Jun 1, 2013 at 10:18
  • Upvoted you. Your steps were much more thorough.
    – dmourati
    Jun 1, 2013 at 18:15
0

I found that having the following set in /etc/puppet/puppet.conf to solve a case where regenerating certs "by the book" still produced the situation described in the Q:

[master]
certname=masterhost.domain.com

[agent]
certname=agenthost.domain.com

(where masterhost.domain.com is the FQDN of the puppetmaster and agenthost.domain.com the same for the agent)

IMO this is rather clear way of ensuring that puppet knows which name is for the master and which is for the agent in the case of having both running on the same host, especially as having just set server=masterhost.domain.com didn't seem to be enough to avoid conflicts.

I didn't find the proposed solution of adding the DN of the puppetmaster in /etc/hosts (I had it as an DNS alias already) so I can't say if that would have helped in my case.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .