I wanted to configure DNS round robin on my Puppet 2.7.23 Master servers. I configured 2 Red Hat 6.5 servers with Puppet running via Rack with Passenger on Apache 2.2.15 with mod_ssl. I configured alt_dns_names and created 2 A records to point to puppet.mydomain.com with the IP of each server. I wasn't really sure what I needed to do to get failover working properly since the certs were being signed by one server or the other, what happens when one goes down and the other doesn't have the respective agent's cert?
I tried adding /etc/puppet/autosign.conf with the content "*" with the understanding that this would allow the master to sign any cert without explicitly running puppet cert sign hostname.
It wasn't working (clients did not just have their certs signed when I ran puppet agent --test on a newly configured agent) so I renamed it to autosign.conf.ignore. I renamed /var/lib/puppet/ssl to ssl.old, did puppet cert clean --all and then puppet cert generate <host.FQDN> and restarted Apache in order to start over. When I run puppet cert list --all on the Master I still see the alt_dns names in the Master's own cert (the only cert present as I have yet to add agents). I deleted the 2 A records for puppet.mydomain and decided to just try a single Master using its own DNS name. I removed the alt_dns line from /etc/puppet/puppet.conf and went through the moving ssl directory and regenerating certs with the hosts DNS name, kicking apache process; but puppet.mydomain still shows up in the puppet cert list --all.
The problem: What I am seeing now is that when I configured the server = DNS name of Master and run puppet agent --test --waitforcert 5 on a client computer, it looks fine on the client, but the cert never shows up on the Master in either puppet cert list or puppet cert list --all. I did a TCPdump and see the client is communicating with the host on port 8140, I see no error in the logs, it just says did not receive certificate over and over on client and the Master sees no cert to sign. Ideas to fix that, and any information pertaining to what I might be missing on the DNS Round Robin failover would be great, but most importantly I need to solve why I cannot add Puppet clients to my Master.
