In summary:

  • Client connects for the first time and requests cert;
  • on the Master, puppetca -s client is executed;
  • Client gets the cert and completes the run successfully.

Fine. But now:

  • on the Master, puppetca -c client is executed and client's cert is not in the cert list anymore;
  • Client connects again and can perform the run as usual;

Restarting puppetmasterd doesn't solve the issue. How can I prevent client to connect once its cert has been revoked?

Thanks in advance

  • What is the message given by puppetca -c client? How do you tell that the client's cert is not in the cert list? What is your OS and Puppet version? How do you run the puppet master? How many clients do you have? – Antonis Christofides Jun 21 '12 at 6:54
  • (1) I don't have a new client to try the -c, but it's the usual success message. (2) -l lists the certs and it's not there anymore. (3) Ubuntu 10.04, puppet 2.7.9 (4) Do you mean service puppetmaster start? (5) 12 clients – chris Jun 21 '12 at 7:47
  • How do you run puppet on the client? puppetd --test? Does puppetd --test run properly? Do the master's log files just show a normal connection and run by the client? – Antonis Christofides Jun 21 '12 at 8:12
  • (1) puppetd --onetime --no-daemonize --verbose --waitforcert 5 (2) --test runs properly, even when the cert has been revoked (3) Unfortunately I've never been able to enable logging on the master... – chris Jun 21 '12 at 8:37
  • Do you have autosign enabled by any chance? /etc/puppet/autosign.conf on your puppetmaster should be either empty or non-existent. – Cosimo Jul 8 '12 at 19:39

First thing you need to do is to verify that the cert is actually revoked from the CA. Fire the following command to check that:

puppetca --list --all

If you are sure that the cert was revoked then ensure that auto-signing is off. Not only the autosign file, check the puppet.conf also. You have to disable it. If you think that your infra will be impacted by turning it off then simply use auth.conf to block the particular host in question.

Hope it helped.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.