Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created an A record for my puppetmaster. In case the puppetmaster on this ip address goes down and I have to spawn a new one from a new ip address, I can just change the ip address associated with the hostname in the A record to that of the new box.

I would like all my puppetclients to be able to connect to the new puppetmaster only by its hostname in the A record.

$ dig

;; ANSWER SECTION:  300     IN      A

My client has the hostname puppetclient-01 and my master has the hostname puppetmaster

On my puppet client I have no entries that resolve the hostname of puppetmaster to a particular IP in /etc/hosts because if puppetmaster goes down and I have to launch a new puppet master from a new ip, I want to avoid changing all the /etc/hosts files in my clients.

In /etc/puppet/puppet.conf of puppetclient-01 the only change I made to the defaults are adding this

server =

On puppetclient-01 I run this

root@puppetclient-01:~# puppet agent --test
info: Creating a new SSL key for puppetclient-01
info: Caching certificate for ca
info: Creating a new SSL certificate request for puppetclient-01
info: Certificate Request fingerprint (md5): 12:34:56:78:CB:81:62:2E:5F:AB:40:54:D0:A1:37:95
Exiting; no certificate found and waitforcert is disabled

Then on puppetmaster I run this

oot@puppetmaster:~# puppetca --sign puppetclient-01
notice: Signed certificate request for puppetclient-01
notice: Removing file Puppet::SSL::CertificateRequest puppetclient-01 at '/var/lib/puppet/ssl/ca/requests/puppetclient-01.pem'

Then on puppetclient-01 when I attempt a puppet run

root@puppetclient-01:~# puppet agent --test
info: Caching certificate for puppetclient-01
err: Could not retrieve catalog from remote server: Server hostname '' did not match server certificate; expected puppetmaster
warning: Not using cache on failed catalog
err: Could not retrieve catalog; skipping run
err: Could not send report: Server hostname '' did not match server certificate; expected puppetmaster

Why do I receive the error Server hostname '' did not match server certificate; expected puppetmaster?

Are there any directives I need to change in etc/puppet/puppet.conf on either the client or master to get this to work correctly?

share|improve this question
check your system clocks. You will want to setup ntp. Delete the cert on the client/server, try again. – dmourati Nov 21 '13 at 0:32
up vote 4 down vote accepted

Looks like you did not use the FQDN when generating the master cert. Following If sudo puppet master --configprint certname on the master produces puppetmaster rather than you'll need to:

Re-generate the puppet master’s certificate:

Stop puppet master. Delete the puppet master’s certificate, private key, and public key:

$ sudo find $(puppet master --configprint ssldir) -name "$(puppet master --configprint certname).pem" -delete

Edit the certname setting in the puppet master’s /etc/puppet/puppet.conf file to match the puppet master’s actual hostname, and the dns_alt_names setting in that file to match any other DNS names you expect the master to need to respond to. Start a non-daemonized WEBrick puppet master instance, and wait for it to generate and sign a new certificate:

$ sudo puppet master --no-daemonize --verbose

You should stop the temporary puppet master with ctrl-C after you see the “notice: Starting Puppet master version 2.6.9” message. Restart the puppet master.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.