I have puppet server setup as part of a docker-composition.
I have nodes inside the composition which connect directly to the container. This works fine because the Puppet master automatically created an SSL certificate using its local name (only available within the docker composition) in a format similar to:
puppet.upgrades.jjk32jl.svc.dockerapp.io
I also have external nodes which aren't part of the composition which need to connect via an external url upgrades.myorg.com
.
When I try to connect with outside nodes I get:
Error: Could not request certificate: Server hostname 'puppet.upgrades.jjk32jl.svc.dockerapp.io' did not match server certificate; expected one of upgrades.myorg.com, DNS:puppet, DNS:upgrades.myorg.com
Can I set up a second certficate for dealing with external nodes (or use an alt-name) to deal with this situation? Or will I need to redirect internal communications between nodes to connect from the outside at upgrades.myorg.com
?
Update:
I've added several alt-names to my master cert it now looks like this when I use puppet cert -la
:
"puppet.c9039f55-d345-45d1-a8bd-8fec89481559.local.dockerapp.io" (SHA256) 4B:A6:1F:C6:EA:8E:69:17:E3:43:C6:AE:A1:AE:BB:7B:9A:4F:09:5C:6F:92:BD:E7:C8:56:43:D8:03:12:59: 58 (alt names: "DNS:puppet", "DNS:puppet-1.upgrades.fdafdafda.cont.dockerapp.io", "DNS:puppet.c9039f55-d345-45d1-a8bd-8fec89481559.local.dockerapp.io", "DNS:puppet.upgrades.jjk32jl.svc.dockerapp.io")
puppet.upgrades.jjk32jl.svc.dockerapp.io
is listed as an alt-name but I get:
Error: Could not request certificate: Server hostname 'puppet.upgrades.jjk32jl.svc.dockerapp.io' did not match server certificate; expected one of puppet.64b21c37-fa14-4406-b931-5add61cf582e.local.dockerapp.io, DNS:puppet, DNS:puppet.64b21c37-fa14-4406-b931-5add61cf582e.local.dockerapp.io
This is confusing because puppet.64b21c37-fa14-4406-b931-5add61cf582e.local.dockerapp.io
isn't mentioned as an alt-name on the master certificate.