my puppet.conf on the master

[master]
certname = myname.mydomain.com
ca_server = myname.mydomain.com
certdnsnames = puppet;puppet.local;myname.dyndns.org;hivemind.local;

for my understanding with the certdnsnames defined the following should work:

puppet agent --server myname.dyndns.org --test

but i get the following error:

err: Could not retrieve catalog from remote server: hostname was not match with the server certificate

how to avoid this error? how to correctly define certdnsnames? i have found diffent documentation about this, but no simple example. i i use "," for seperation i cannot sign at all. i also have seen a syntax like

certdnsnames = puppet:puppet.intra.myserver.fr,puppet.myserver.fr:puppet,puppet:puppet,puppet.intra.myserver.fr,puppet.myserver.fr

http://projects.puppetlabs.com/issues/5776

but for me its not clear when to add a "puppet:" and when not.

up vote 25 down vote accepted

For the benefit of anyone else who stumbles upon this answer:

Due to CVE-2011-3872, Puppet no longer supports the certdnsnames option. From the documentation:

The certdnsnames setting is no longer functional, after CVE-2011-3872. We ignore the value completely. For your own certificate request you can set dns_alt_names in the configuration and it will apply locally. There is no configuration option to set DNS alt names, or any other subjectAltName value, for another nodes certificate. Alternately you can use the --dns_alt_names command line option to set the labels added while generating your own CSR.

You can generate an SSL certificate for your server using subjectAlternativeName like this:

$ puppet cert generate <puppet master's certname> --dns_alt_names=<comma-separated list of DNS names>
  • 3
    Additional note: Before running puppet cert generate, remove the .pem files for the puppet master in /var/lib/puppet/ssl/private_keys, /var/lib/puppet/ssl/ca/signed/ and /var/lib/puppet/ssl/certs. Generating a new certificate is not killing connectivity to existing clients, as they verify the certificate of the puppetmaster using the CA's certificate, which they downloaded at first connect. – Erik Forsberg Jun 27 '12 at 19:27
  • 9
    Hey, thanks Lars from the past. You just answered my question. – larsks Feb 16 '13 at 4:18

For Puppet 4+ use the following commands to change the accepted dns names for the puppetserver certificate:

Rename existing certificates to *.backup:

mv /etc/puppetlabs/puppet/ssl/private_keys/$(hostname -f).pem{,.backup}
mv /etc/puppetlabs/puppet/ssl/ca/signed/$(hostname -f).pem{,.backup}
mv /etc/puppetlabs/puppet/ssl/certs/$(hostname -f).pem{,.backup}

generate new certificate (add your desired alt names):

puppet cert generate $(hostname -f) --dns_alt_names=$(hostname -f),puppet

restart puppetserver to use new certificates

service puppetserver restart
  • sorry for not accepting this answer, i had a translation problem with "colon" so the other answer helped me out by simply showing me the right char :) but thank you for your answer – c33s Oct 10 '11 at 14:09

According to

puppet agent --genconfig

you must use a colon-separated (":" not ";") list.

So it should be

certdnsnames = 'puppet:puppet.local:myname.dyndns.org:hivemind.local'

HTH

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.