I am new to setting up Puppet and Puppetmaster... We have puppets setup previously, and new new puppetmaster...

3rd edit

After deleting the ssl files on both master(ghive-ldap) and client (giab10)

The hostname for master is ghive-ldap and in client's hostname I have that.

On master:

puppet cert clean ghive-ldap
puppet cert generate --dns_alt_names ghive-ldap ghive-ldap

sudo puppetca --sign giab10
err: Could not call sign: Could not find certificate request for giab10

so then on the client:

sudo puppet cert --generate giab10
notice: giab10 has a waiting certificate request
notice: Signed certificate request for giab10
notice: Removing file Puppet::SSL::CertificateRequest giab10 at '/var/lib/puppet/ssl/ca/requests/giab10.pem'
notice: Removing file Puppet::SSL::CertificateRequest giab10 at '/var/lib/puppet/ssl/certificate_requests/giab10.pem'
giabadmin@giab10:~$ sudo puppet cert --list --all
+ giab10 (0F:CB:............)

I ran this on the client

sudo puppetd --test --debug
err: Could not retrieve catalog from remote server: getaddrinfo: Name or service not know

Fine... let me try this on the client

sudo puppet agent --server ghive-ldap --waitforcert 60 --test --verbose
err: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed
warning: Not using cache on failed catalog
err: Could not retrieve catalog; skipping run

Garrrrr..... I deleted the ssl files and still no luck!! Something must have gone wrong...

How do I start from the beginning? I didn't much help from the documentation...Sorry for being a noob.. Thanks

PS: Also, how do you make sure the two servers have time in sync?

1 Answer 1


Which hostname(s) did the puppetmaster generate its certificate for? The puppet client expects the certificate to be valid for "puppetmaster", but it doesn't seem to be issued for this hostname. I think "puppet" might be the default CN on the puppetmaster, or else the hostname of the server. You can check it by running "openssl x509 -text -in cert.pem" on the certificate of the server, or connect to https://yourpuppetmaster:8140/ with a browser, and see which domains are in the CN and dns_alt_names of the certificate.


You have a certificate only for "master", but your client connects to "puppetmaster". So either the client needs to expect "master", or you need a certificate for "puppetmaster" on your master. A "certname=puppetmaster" in the [master] block in puppet.conf will change the CN on the server (http://docs.puppetlabs.com/references/stable/configuration.html#certname). You may need to remove the old certificates, but I am not sure about this. Or, you can have the client connect to "master", either by adding it to /etc/hosts, or to your DNS zone if you're running one.

  • 1
    Thanks,. I've updated my post above. Do they seem to do something weird?
    – CppLearner
    Jun 13, 2012 at 23:50
  • You're connecting to "puppetmaster", but the puppetmaster only has a certificate it can use for "master".
    – arjarj
    Jun 14, 2012 at 16:38
  • Thanks. Question... if the hostname for the master is not puppetmaster, should I just go back to /etc/hosts and put the actual hostname there? Will that make more sense? THanks
    – CppLearner
    Jun 14, 2012 at 17:02
  • It's a matter of preference I guess. I am usually hesitant to mess with the certificate stuff, so I'd just stick the hostname in /etc/hosts or DNS and be done with it. If you plan on growing to a lot more hosts and want to use the hostname you picked, I'd investigate the certname or dns_alt_names options.
    – arjarj
    Jun 14, 2012 at 17:17
  • Thanks. Just a quick question... sorry for being a noob. I would like start the whole certificate over. Where should I begin starting over? I deleted /var/lib/puppets/ssl/ and /etc/puppets/ssl on both master and clinet... assuming that putting the actual hostname in /etc/hosts will make things smoother
    – CppLearner
    Jun 14, 2012 at 17:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .