We started getting an error from one of the Puppet-agents:

Could not send report: SSL_connect returned=1 errno=0 state=SSLv3 read finished A: sslv3 alert certificate revoked

Indeed, according to puppet cert list $h on the server, the certificate was revoked. I cleaned it on the master, deleted the /var/lib/puppet/ssl on the client and all was fine.

I then ran puppet cert list --all | grep revoked -- and found over 20 other clients listed as "revoked" too. Spot checking the list I found, that puppet-agent did not have a problem on any of these others.

My questions:

  1. What would cause Puppet to "revoke" a particular client's certificate? It certainly was not done by a human administrator...
  2. Why would such revokations not break things for most clients -- but only for some?

Using puppet-2.7.25 on the clients (RHEL6) and 2.7.18 on the server (RHEL5). Thanks!

  • For the ones listed as revoked, do they also have a different cert in inventory for that host that's not revoked? Nov 25 '14 at 0:18
  • 1
    Are your certificates expiring? 2.7 has been EOL for some time now. And did someone run puppet node clean on the nodes? Nov 25 '14 at 0:20
  • No, actually -- most of the hosts involved are new and their certs are only a few months old. Besides, they aren't listed as "expired" -- but rather as "revoked".
    – Mikhail T.
    Nov 25 '14 at 0:38
  • Shane, no the "revoked" entries are the only ones for each host involved.
    – Mikhail T.
    Nov 25 '14 at 0:43
  • @MikhailT. What web server setup is your puppet master using - the default webrick, or something like Passenger/Apache? Also, what are the revocation timestamps listed as from openssl crl -in /var/lib/puppet/ssl/crl.pem -noout -text? Nov 25 '14 at 0:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.