I am new to setting up Puppet and Puppetmaster... We have puppets setup previously, and new new puppetmaster...

3rd edit

After deleting the ssl files on both master(ghive-ldap) and client (giab10)

The hostname for master is ghive-ldap and in client's hostname I have that.

On master:

puppet cert clean ghive-ldap
puppet cert generate --dns_alt_names ghive-ldap ghive-ldap

sudo puppetca --sign giab10
err: Could not call sign: Could not find certificate request for giab10

so then on the client:

sudo puppet cert --generate giab10
notice: giab10 has a waiting certificate request
notice: Signed certificate request for giab10
notice: Removing file Puppet::SSL::CertificateRequest giab10 at '/var/lib/puppet/ssl/ca/requests/giab10.pem'
notice: Removing file Puppet::SSL::CertificateRequest giab10 at '/var/lib/puppet/ssl/certificate_requests/giab10.pem'
giabadmin@giab10:~$ sudo puppet cert --list --all
+ giab10 (0F:CB:............)

I ran this on the client

sudo puppetd --test --debug
err: Could not retrieve catalog from remote server: getaddrinfo: Name or service not know

Fine... let me try this on the client

sudo puppet agent --server ghive-ldap --waitforcert 60 --test --verbose
err: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed
warning: Not using cache on failed catalog
err: Could not retrieve catalog; skipping run

Garrrrr..... I deleted the ssl files and still no luck!! Something must have gone wrong...

How do I start from the beginning? I didn't much help from the documentation...Sorry for being a noob.. Thanks

PS: Also, how do you make sure the two servers have time in sync?


Which hostname(s) did the puppetmaster generate its certificate for? The puppet client expects the certificate to be valid for "puppetmaster", but it doesn't seem to be issued for this hostname. I think "puppet" might be the default CN on the puppetmaster, or else the hostname of the server. You can check it by running "openssl x509 -text -in cert.pem" on the certificate of the server, or connect to https://yourpuppetmaster:8140/ with a browser, and see which domains are in the CN and dns_alt_names of the certificate.


You have a certificate only for "master", but your client connects to "puppetmaster". So either the client needs to expect "master", or you need a certificate for "puppetmaster" on your master. A "certname=puppetmaster" in the [master] block in puppet.conf will change the CN on the server (http://docs.puppetlabs.com/references/stable/configuration.html#certname). You may need to remove the old certificates, but I am not sure about this. Or, you can have the client connect to "master", either by adding it to /etc/hosts, or to your DNS zone if you're running one.

  • 1
    Thanks,. I've updated my post above. Do they seem to do something weird? – CppLearner Jun 13 '12 at 23:50
  • You're connecting to "puppetmaster", but the puppetmaster only has a certificate it can use for "master". – arjarj Jun 14 '12 at 16:38
  • Thanks. Question... if the hostname for the master is not puppetmaster, should I just go back to /etc/hosts and put the actual hostname there? Will that make more sense? THanks – CppLearner Jun 14 '12 at 17:02
  • It's a matter of preference I guess. I am usually hesitant to mess with the certificate stuff, so I'd just stick the hostname in /etc/hosts or DNS and be done with it. If you plan on growing to a lot more hosts and want to use the hostname you picked, I'd investigate the certname or dns_alt_names options. – arjarj Jun 14 '12 at 17:17
  • Thanks. Just a quick question... sorry for being a noob. I would like start the whole certificate over. Where should I begin starting over? I deleted /var/lib/puppets/ssl/ and /etc/puppets/ssl on both master and clinet... assuming that putting the actual hostname in /etc/hosts will make things smoother – CppLearner Jun 14 '12 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.