1

I am running the following setup of Puppet :

  • Puppet master : CentOS 6.4 x86_64 with puppet-server-3.2.1-2.2 and openssl-1.0.0-27.el6_4.2.x86_64
  • Puppet agent 1 : RedHat AS 4.8 x86 with puppet-0.25.6-1.el4 and openssl-0.9.7a-43.20.el4
  • Puppet agent 2 : RHEL 5.10 x86 with puppet-2.6.18-3.el5 and openssl-0.9.8e-26.el5_9.1

I noticed that my RedHat 4 agent cannot connect to my Puppet master and I think the reason is because the version of the libssl packaged with RH4 (0.9.7a-43.20 in my case) cannot manage the digests generated by the Puppet server.

The tests I performed :

  • From a non-working RedHat 4 agent (with OpenSSL v0.9.7a-43.20.el4) :

# openssl s_client -host puppetmaster.test.lan -port 8140 -cert /etc/puppet/ssl/certs/rh4as.test.lan.pem -key /etc/puppet/ssl/private_keys/rh4as.test.lan.pem -CAfile /etc/puppet/ssl/certs/ca.pem 
CONNECTED(00000003)
depth=1 /CN=Puppet CA: puppetmaster.test.lan
verify return:1
depth=0 /CN=puppetmaster.test.lan
verify error:num=7:certificate signature failure
verify return:1
depth=0 /CN=puppetmaster.test.lan
verify return:1
---
Certificate chain
 0 s:/CN=puppetmaster.test.lan
   i:/CN=Puppet CA: puppetmaster.test.lan
 1 s:/CN=Puppet CA: puppetmaster.test.lan
   i:/CN=Puppet CA: puppetmaster.test.lan
---
Server certificate
-----BEGIN CERTIFICATE-----
[...]
-----END CERTIFICATE-----
subject=/CN=puppetmaster.test.lan
issuer=/CN=Puppet CA: puppetmaster.test.lan
---
No client certificate CA names sent
---
SSL handshake has read 3793 bytes and written 2853 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 4096 bit
Secure Renegotiation IS supported
SSL-Session:
Protocol  : TLSv1
Cipher    : DHE-RSA-AES256-SHA
Session-ID: 8B8607495273640FB4BCB80C5C1CE261FED1633CA112C1D216BE187EDEA81F77
Session-ID-ctx: 
Master-Key: A2A3AC5B0679C27FFE070D0B3154233EC4D0F17310148AE7B6FF502A7DB95679D33BB097C0ED89AE67AA42E95BD4D952
Key-Arg   : None
Krb5 Principal: None
Start Time: 1392216496
Timeout   : 300 (sec)
Verify return code: 7 (certificate signature failure)
---
closed
  • From a working RedHat 5 agent (with OpenSSL v0.9.8e-26.el5_9.1) :

# openssl s_client -host puppetmaster.test.lan -port 8140 -cert /etc/puppet/ssl/certs/rhel5.test.lan.pem -key /etc/puppet/ssl/private_keys/rhel5.test.lan.pem -CAfile /etc/puppet/ssl/certs/ca.pem
CONNECTED(00000003)
depth=1 /CN=Puppet CA: puppetmaster.test.lan
verify return:1
depth=0 /CN=puppetmaster.test.lan
verify return:1
---
Certificate chain
 0 s:/CN=puppetmaster.test.lan
   i:/CN=Puppet CA: puppetmaster.test.lan
 1 s:/CN=Puppet CA: puppetmaster.test.lan
   i:/CN=Puppet CA: puppetmaster.test.lan
---
Server certificate
-----BEGIN CERTIFICATE-----
[...]
-----END CERTIFICATE-----
subject=/CN=puppetmaster.test.lan
issuer=/CN=Puppet CA: puppetmaster.test.lan
---
No client certificate CA names sent
---
SSL handshake has read 3793 bytes and written 2831 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol  : TLSv1
Cipher    : DHE-RSA-AES256-SHA
Session-ID: 7B70B803D8D0FFC65F2696D337EB40CDE41D188F9F1BA1D7FE416DA326B49AFD
Session-ID-ctx: 
Master-Key: BE57138CA99AA4AA59769B3E8396E9C25594264E196FB50DB066679EA569311521F1BBBCD25962B780A38D95A3AD9346
Key-Arg   : None
Krb5 Principal: None
Start Time: 1392224552
Timeout   : 300 (sec)
Verify return code: 0 (ok)
---
closed
  • From the Puppet master :

# puppet cert --list --all
+ "rh4as.test.lan"      (SHA256) 69:BD:D9:B6:31:6B:3E:90:9B:5E:1B:90:FA:24:08:1A:48:31:B1:17:65:DF:93:26:70:29:5A:C3:3E:C8:0F:7E
+ "rhel5.test.lan"      (SHA256) 83:58:A9:25:7C:9A:41:C9:A7:7E:45:26:40:EE:D0:05:9A:31:6E:8D:15:CE:57:86:0C:DA:E0:D0:2A:9C:B3:DB
+ "puppetmaster.test.lan" (SHA256) 9C:AC:8E:CA:71:24:2B:BB:61:52:01:4F:F1:DF:BD:B6:25:6C:DA:61:44:E4:1E:71:77:DF:2F:BA:AE:A9:40:FD (alt names: "DNS:puppet", "DNS:puppet.test.lan", "DNS:puppetmaster.test.lan", "DNS:puppetmaster")

Additional tests :

  • I made sure all the servers are correctly synchronized with the NTP server
  • I deleted all local certificates on the RH4AS agent and reissued them
  • I deleted local references to the RH4AS agent on the Puppet master
  • I installed from source Puppet agent v2.6.0 on the RH4AS server but had the same issue

I read these links :

and I realized I had 2 options :

  • upgrade my OpenSSL version to +0.9.8 (1.0.0 to be safe)
  • downgrade the digest used by the Puppet master from SHA256 to SHA1 (or maybe even MD5)

Unfortunately, option #1 (upgrade OpenSSL) is not applicable in my environment. So I guess I'm stuck with downgrading the digest used by the Puppet master. But I can't find an option in the whole man puppet.conf that could be used towards this goal. I tried to play with the keylength parameter but to no avail.

If anybody can help me on this issue, I would really appreciate.

Thanks in advance to all.

  • Puppet 0.25 is ancient. Please try upgrading it to 2.7, which is the oldest puppet release that is still supported. Even 2.7 will be end-of-life on September 30, 2014; see groups.google.com/forum/#!msg/puppet-users/8JEy7wY5VPs/… – sciurus Feb 13 '14 at 1:24
  • I installed Puppet agent v2.6.0 to try if the old agent version was the problem here but I had the same issue. Do you think installet Puppet agent v2.7 will do ? – Iceman94 Feb 13 '14 at 12:31
  • Since your 2.6 agent on RHEL5 works, upgrading RHEL4 past 2.6 seems unnecessary for solving this specific problem. – sciurus Feb 13 '14 at 14:44
0

It looks like you have the problem discussed at Feature #21029: Allow control over the digest used to create CA certificates. It seems like a workaround for this will not be implemented in puppet, and so you need to create the certificates manually with OpenSSL.

| improve this answer | |
  • Thank you for the link. I'll try to create manually the certificates using directly OpenSSL and I'll let you know. – Iceman94 Feb 13 '14 at 19:09
  • FYI, I added a post on Puppet-dev Google group regarding this issue : groups.google.com/d/msg/puppet-dev/_jkdY1Hmq6U/QJ6nHP2ORtYJ – Iceman94 Feb 18 '14 at 14:16
  • Did you have any luck manually creating the ssl certificates? Would you consider accepting this answer? – sciurus Feb 18 '14 at 20:51
  • I am still in the process of creating a new CA SHA1-compliant and using it to sign the CSR coming from my Puppet agents. I'll let you know if it works. – Iceman94 Feb 19 '14 at 18:33
1

I ended up downgrading my Puppet Master version from the 3.x branch to 2.7.x (as indicated in this post : https://groups.google.com/forum/#!msg/puppet-dev/_jkdY1Hmq6U/QJ6nHP2ORtYJ).

But I consider as probably valid the answer of sciurus, as I was told by Puppet devs that I could work around this issue by setting up a SHA1-compliant CA.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.