I'm trying to setup a basic puppet agent/master use-case with an agent server and a master. I've setup two servers with puppet and puppet master respectively.

After the following setup of both servers:

puppet master --no-daemonize --verbose
puppet agent --test
puppet cert --list to get the list, 
puppet cert --sign <certname> to sign it.
puppet agent --test

I get the message:

err: Could not retrieve catalog from remote server: hostname was not match with the server certificate
warning: Not using cache on failed catalog
err: Could not retrieve catalog; skipping run
err: Could not send report: hostname was not match with the server certificate

What do I need to do in order to get the agent/master to be able to talk to each other?


Make sure your client can resolve "puppet". Forward and reverse DNS entries are important. As a quick test, add an entry to /etc/hosts with your puppet master's IP and name and try again.

| improve this answer | |
  • 1
    Agreed about forward records. In my experience, though, puppet couldn't care less about PTR records. – EEAA Jun 18 '12 at 20:35
  • I've had issues when I didn't have the proper reverse entry in place. The /etc/hosts file approach is a safe bet, though. – ewwhite Jun 18 '12 at 20:37

Also check your resolver file as well and delete the ssl directory in both areas then restart the sync process. Obviously you know the puppetca --list command to check to see if a certificate needs to be signed. You may also try to turn off your firewall and see if that allows the connection. Check out the /etc/hosts to make sure its all there.

| improve this answer | |

Make sure the clocks on your puppetmaster and your client have the same time.
I've had clients fail to get their certs because the times of the two systems were too far out of sync.

| improve this answer | |

Make sure that you have this in the puppet master config file: certname = "the server name you have in your puppet.conf on your clients"

Eg. certname = puppet.cakeservers.com if you have server = puppet.cakeservers.com in your clients.

Best Regards
Espen Fjellvær Olsen

| improve this answer | |

Are you setting the name of the server anywhere in your configuration? In the [master] block in your /etc/puppet/puppet.conf on the Puppetmaster you should have your ca_name and your certname set to something like the following:

ca_name = Puppet CA: puppetmaster.example.com
certname = puppetmaster.example.com

Make sure that the server's certificate matches this name. You can have a different certificate name from the actual machine's hostname.

In your [agent] bock, you'd then specify the server with:

server = puppetmaster.example.com

From the client, you should then be able to run puppet agent --test without problems, assuming, of course, that puppetmaster.example.com is in DNS and reachable.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.