Puppet hostname doesn't match server certificate

Question

I'm trying to set up a Ubuntu VM with puppet installed so I can locally test our production setup. I'm having trouble getting puppetmaster and puppet to talk to each other. Let me take you through my steps. (The server's hostname is a FQDN of the format "web1.xxx.xxx.net").

So firstly, I clear out all the pem files (except the CA pems of course) from the /etc/puppet/ssl directory so I can do a fresh start. puppetca --list returns no results.

Then, I run puppetd --test to generate a CSR for the puppetmaster. puppetca --list now includes my hostname ("web1.xxx.xxx.net").

Then I run puppetca --sign web1.xxx.xxx.net. Now puppetca --list is empty again -- everything working fine so far.

Lastly I run puppetd --test again. I get the following output:

err: Could not retrieve catalog from remote server: hostname was not match with the server certificate
warning: Not using cache on failed catalog
err: Could not retrieve catalog; skipping run

Listing the contents of the /etc/puppet/ssl directory shows PEM files with the correct server name, which matches my hostname. Anyone have any ideas on how to attack this problem?

Answer 1

The error is because the client by default connects to the server hostname 'puppet' but the certificate presented does not have 'puppet' either as its subject or as a SubjectAltName attribute.

To fix it, you can (pick one):

1. instead of initializing your puppetmaster's certificate by running puppetd, initialize it by running puppetmasterd -- this will cause the cert subject name to include "puppet".

2. instead of leaving things to chance you can use puppetca --generate --certdnsnames puppet:puppet.mydomain.com web1.xx.xx.xx.net -- the certdnsnames option specifies a list of SubjectAltNames which will be included in the certificate; it should have a colon-separated list of any name that a client would use to contact the server.

3. instead of just running puppetd --test on the client, run puppetd --test --server=web1.xx.xx.xx.net so the server name the client connects to is one that actually exists in the certificate presented by the server.

Check out masterzen's excellent blog entry for further troubleshooting: Puppet SSL Explained

Answer 2

Did you check the puppetmaster log file? I found the same problem, and found that the server logs the certificate info:

[2012-02-28 16:21:09] INFO  
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2 (0x2)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: CN=ca
        Validity
            Not Before: Feb 26 16:32:46 2012 GMT
            Not After : Feb 24 16:32:46 2017 GMT
        Subject: CN=ubuntu.localdomain

The field Subject shows that the CN is "ubuntu.localdomain", so I executed the puppet by doing:

puppetd -t --server=ubuntu.localdomain --fqdn=myfqdn

Hope this helps :-)

Answer 3

In addition to what Pau answered, I'd just like to highlight that you can inspect the puppetmasters certificate using:

openssl x509 -text -in /var/lib/puppet/ssl/certs/<hostname_of_puppet_master>

Then make sure that you use the exact same hostname when from the client:

puppetd --server <hostname_of_puppet_master> <etc>

Answer 4

Are both servers able to resolve each other? My guess is that since you are VMing it you might be missing the name resolution. If you don't use DNS to let the servers resolve each other you need to add entries to your /etc/hosts file on both servers.

Puppet requires the hostnames to resolve to the correct IPs, without this you will get the error you mentioned. You may need to recreate certificates after doing this. Both machines should be able to ping each by hostname.

Another thing to be careful of with VMs is that you sync the times on the servers. If you don't it is likely the certificates will be invalid.