0

I have puppet server setup as part of a docker-composition.

I have nodes inside the composition which connect directly to the container. This works fine because the Puppet master automatically created an SSL certificate using its local name (only available within the docker composition) in a format similar to:

puppet.upgrades.jjk32jl.svc.dockerapp.io

I also have external nodes which aren't part of the composition which need to connect via an external url upgrades.myorg.com.

When I try to connect with outside nodes I get:

Error: Could not request certificate: Server hostname 'puppet.upgrades.jjk32jl.svc.dockerapp.io' did not match server certificate; expected one of upgrades.myorg.com, DNS:puppet, DNS:upgrades.myorg.com

Can I set up a second certficate for dealing with external nodes (or use an alt-name) to deal with this situation? Or will I need to redirect internal communications between nodes to connect from the outside at upgrades.myorg.com?


Update:

I've added several alt-names to my master cert it now looks like this when I use puppet cert -la:

"puppet.c9039f55-d345-45d1-a8bd-8fec89481559.local.dockerapp.io" (SHA256) 4B:A6:1F:C6:EA:8E:69:17:E3:43:C6:AE:A1:AE:BB:7B:9A:4F:09:5C:6F:92:BD:E7:C8:56:43:D8:03:12:59: 58 (alt names: "DNS:puppet", "DNS:puppet-1.upgrades.fdafdafda.cont.dockerapp.io", "DNS:puppet.c9039f55-d345-45d1-a8bd-8fec89481559.local.dockerapp.io", "DNS:puppet.upgrades.jjk32jl.svc.dockerapp.io")

puppet.upgrades.jjk32jl.svc.dockerapp.io is listed as an alt-name but I get:

Error: Could not request certificate: Server hostname 'puppet.upgrades.jjk32jl.svc.dockerapp.io' did not match server certificate; expected one of puppet.64b21c37-fa14-4406-b931-5add61cf582e.local.dockerapp.io, DNS:puppet, DNS:puppet.64b21c37-fa14-4406-b931-5add61cf582e.local.dockerapp.io

This is confusing because puppet.64b21c37-fa14-4406-b931-5add61cf582e.local.dockerapp.io isn't mentioned as an alt-name on the master certificate.

1 Answer 1

2

The cleanest way to handle this would be to add another alt name. You'd do this by setting the dns_alt_names option, then following the procedure to regenerate the master's certificate (adding the new names) that's listed in the documentation for the alt names option here.

2
  • Sorry I marked correct too quickly. Unfortunately still having the same issue even with alt-name. Have updated question. Thanks for your help May 31, 2017 at 16:42
  • It ended up being that the container name had changed and I had to add the new name again. So this answer did work. My mistake. All the best. May 31, 2017 at 18:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .