2

I was hoping someone might have an answer for this:

While upgrading overall from Centos6 to Centos7 I'm handling the upgrade for puppet's version. Our new puppet server's version is 3.6.2 and I'd like it to work with the somewhat older puppet clients whose version is 2.7.25.

This is the problem I'm running into:

puppet cert --list --all

+"XXX.YYY.com"   (MD5) 7C:0D:73:12:D6:53:62:94:12:DF:0F:1E:4E:DC:C5:34

+"puppet.polldev.com"    (SHA256) 74:8D:84:3F:B4:FC:F6:5A:12:22:B0:63:2A:44:15:93:FB:47:E2:70:AA:F7:AF:B4:E8:62:D8:84:3B:CC:77:10

Then when I try to sign:

puppet cert sign XXX.YYY.com

Warning: Sections other than main, master, agent, user are deprecated in puppet.conf. Please use the directory environments feature to specify environments. (See http://docs.puppetlabs.com/puppet/latest/reference/environments.html) (at /usr/share/ruby/vendor_ruby/puppet/settings/config_file.rb:77:in `collect')

Error: unknown message digest algorithm

Are there any workarounds or solutions for this which don't involve setting up an external CA or using 3.x clients as well?

Thanks, I'd appreciate any help on this if anyone has any ideas.

Improve this question

2 Answers 2

Reset to default
0

I had the same problem. You have to update your puppet clients:

https://tickets.puppetlabs.com/browse/PUP-3176

Improve this answer
1
  • A workaround I found in the mean time (which at least lets me sign the certificates without having to upgrade the clients) is this: sed -i -e 's/csr.sign(key, OpenSSL::Digest::MD5.new)/csr.sign(key, OpenSSL::Digest::SHA256.new)/' /usr/lib/ruby/site_ruby/1.8/puppet/ssl/certificate_request.rb It's ugly but since at the moment I can't afford to upgrade the clients it might be a temporary solution.
    – Arkandel
    Jan 19, 2015 at 16:36
0

These are two unrelated issues.

  1. The first warning is about Directory Environments, which are the replacement of the old dynamic environments. See the mentioned URL.

  2. The Error is the real problem. I think a Puppet agent that old will be using MD5 as a message digest, which new servers will not accept due to FIPS compliancy. You need to update your clients to something that supports at least SHA-1 or SHA-256. Version 2.7 is EOL (see thread at https://groups.google.com/forum/#!msg/puppet-users/8JEy7wY5VPs/9N07fgfU1mAJ)

You may also want to ask the Puppet-Users mailing-list. There are some smart people on there that may be able to provide a workaround for upgrading your agents. 2.7 is pretty old though, so any workaround should a be temporary one while you upgrade your agents.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .