2

Trying to fetch a module, I have the following output

Notice: Preparing to install into /usr/local/etc/puppet/modules ...
Notice: Downloading from https://forgeapi.puppetlabs.com ...
Error: Could not connect via HTTPS to https://forgeapi.puppetlabs.com
  Unable to verify the SSL certificate
    The certificate may not be signed by a valid CA
    The CA bundle included with OpenSSL may not be valid or up to date

But my /etc/ssl/cert.pem is linked correctly, and the package ca_root_nss-3.16.3 is up to date. Is there any information I can get from Puppet about how to proceed with diagnosing this? Maybe it's looking in the wrong location?

4
  • Are you sure your system clock and timezone is properly configured?
    – Zoredache
    Aug 26, 2014 at 21:27
  • I don't think this is a Puppet issue - it might be with Ruby, though. Have you strace d your command to find out whether the up-to-date certificate file is actually read? Can you check that the current GeoTrust SSL CA - G2 is in there? Aug 26, 2014 at 22:35
  • Thank you both for the excellent advice: I checked date (which happened to be wildly off, but no dice); and I ran ktrace. In fact, puppet was attempting to read /usr/local/openssl/cert.pem, and upon symlinking my cert.pem there the error was fixed. This might be an issue with the port or something, which I'll pursue further. Thanks again.
    – A__A__0
    Aug 27, 2014 at 0:34
  • Answer should be accepted instead of documenting in a question that this has been answered
    – 030
    Oct 22, 2014 at 16:48

1 Answer 1

1

I suppose I should be explicit about my solution. Following Felix Frank's advice to use strace (ktrace in FreeBSD), I performed

ktrace -d puppet module install puppetlabs/apache

the -d flag just being there in case child processes were involved. Then, to recover the trace in a human readable format,

kdump | less

which revealed among other things the following bit

 84579 ruby19   CALL  open(0x804453968,0,0x1b6)
 84579 ruby19   NAMI  "/usr/local/openssl/cert.pem"
 84579 ruby19   RET   open -1 errno 2 No such file or directory

It isn't clear to me yet whether my system is just incorrectly configured, and that cert.pem was supposed to be there; or whether some other issue is at play. Either way, it fixed the immediate problem of not being able to install the module.

1
  • Good work. Glad that did some good. Still got a hunch that you will want to check your Ruby setup. Aug 27, 2014 at 20:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .