Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
In summary:
puppetca -s client is executed;Fine. But now:
puppetca -c client is executed and client's cert is not in the cert list anymore;Restarting puppetmasterd doesn't solve the issue. How can I prevent client to connect once its cert has been revoked?
Thanks in advance
First thing you need to do is to verify that the cert is actually revoked from the CA. Fire the following command to check that:
puppetca --list --all
If you are sure that the cert was revoked then ensure that auto-signing is off. Not only the autosign file, check the puppet.conf also. You have to disable it. If you think that your infra will be impacted by turning it off then simply use auth.conf to block the particular host in question.
Hope it helped.
puppetca -c client? How do you tell that the client's cert is not in the cert list? What is your OS and Puppet version? How do you run the puppet master? How many clients do you have? – Antonis Christofides Jun 21 '12 at 6:54-c, but it's the usual success message. (2)-llists the certs and it's not there anymore. (3) Ubuntu 10.04, puppet 2.7.9 (4) Do you meanservice puppetmaster start? (5) 12 clients – chris Jun 21 '12 at 7:47puppetd --test? Doespuppetd --testrun properly? Do the master's log files just show a normal connection and run by the client? – Antonis Christofides Jun 21 '12 at 8:12puppetd --onetime --no-daemonize --verbose --waitforcert 5(2)--testruns properly, even when the cert has been revoked (3) Unfortunately I've never been able to enable logging on the master... – chris Jun 21 '12 at 8:37autosignenabled by any chance?/etc/puppet/autosign.confon your puppetmaster should be either empty or non-existent. – Cosimo Jul 8 '12 at 19:39