1

I have a puppetmaster server and four puppet agent clients. Here I'm attaching my puppet.conf files and hosts in all node. When I call 'puppet cert list' it returns nothing.

But, when called with --all flags it returns the certificate of its own.

I can able to ping puppet, puppetmaster from all agents. 'puppet agent --test' on agents gives the following, Exiting; no certificate found and waitforcert is disabled

How can I get the certificate requests to master from agents. Can anyone give me a solution to this problem? [1] puppet.conf https://drive.google.com/file/d/0ByrsDKrxH15uaThvQm9VRHBtaTg/view?usp=sharing

[2]hosts https://drive.google.com/file/d/0ByrsDKrxH15uVktSYmhDN1NHaGc/view?usp=sharing

Improve this question
14
  • Could you run the following command in she shell of your puppet client(s) and post back the result. dig puppet.example.com +short
    – Nikolas Sakic
    Mar 10, 2015 at 6:59
  • It returns nothing
    – Fasna
    Mar 10, 2015 at 7:04
  • That is your problem. You are using 'puppet.example.com' as your puppet server, when you can't even resolve puppet.example.com. 'example.com' is an external domain, as soon as your try to access exmaple.com, your DNS client try to resolve it. Why are you using blablabla.example.com??? Why not use IP address of your puppet server in your configuration?
    – Nikolas Sakic
    Mar 10, 2015 at 7:12
  • What version of puppet client are you using? You can either delete the certificate (delete 'ssl' directory and all its sub-directories on puppet client. Then start your puppet client again, it will re-create the certificate. Or you can uninstall, rei-install and change your puppet server address and then run the puppet client.
    – Nikolas Sakic
    Mar 10, 2015 at 7:14
  • Clients and server both are version 3.7.4, I've deleted the ssl directories and edited the puppet.conf files and still the same thing happens in clients. I mean, it still produce the four lines root@mgt2:~# puppet agent --no-daemonize --verbose --waitforcert 2 Info: Creating a new SSL key for mgt2.private.wso2.com Info: Caching certificate for ca Info: Caching certificate_request for mgt2.private.wso2.com Info: Caching certificate for ca Notice: Did not receive certificate
    – Fasna
    Mar 10, 2015 at 7:27

2 Answers 2

Reset to default
1

The first time you run:

puppet agent -t

on a new puppet client, it creates a certificate request which is sent to the puppet master (as configured in the client's /etc/puppet/puppet.conf).

Then, on the puppet master you should run:

puppet cert list

Identify the relevant certificate and then sign it:

puppet cert sign hostname_of_puppet_client

Make sure that the certificate request which is created in the puppet master is identified by a the puppet client's hostname rather than IP cause otherwise it may cause you problems in the future.

Also, make sure that the time on both puppet master and client is sync'ed.

After the certificate is signed properly in the puppet master, you should run again on the client:

puppet agent -t

Then, the client should download puppet catalog and run the tasks.

Improve this answer
0

When I encountered this I had to restart the puppet master (had to kill the process). I don't know yet why it helped, but perhaps there is some sort of cache in the master for hosts who were signed already (in my case it happened when i wanted to regenerate the certificate for a host)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .