I have installed a puppetdb on one of my puppetmaster and it works. But I'm not able to connect a second one to the puppet master.

The command "puppet agent -t" works on my 2nd master.

Each master deals with their own nodes (their is no LB).

Here is the puppetserver.log when I run the puppet agent command :

2017-06-22 15:48:21,255 ERROR [qtp1178717687-64] [c.p.h.c.i.PersistentSyncHttpClient] Error executing http request
javax.net.ssl.SSLHandshakeException: General SSLEngine problem
        at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431) ~[na:1.8.0_65]
        at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535) ~[na:1.8.0_65]
        at sun.security.ssl.SSLEngineImpl.writeAppRecord(SSLEngineImpl.java:1214) ~[na:1.8.0_65]
        at sun.security.ssl.SSLEngineImpl.wrap(SSLEngineImpl.java:1186) ~[na:1.8.0_65]
        at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:469) ~[na:1.8.0_65]
        at org.apache.http.nio.reactor.ssl.SSLIOSession.doWrap(SSLIOSession.java:263) ~[puppet-server-release.jar:na]
        at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:303) ~[puppet-server-release.jar:na]
        at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:507) ~[puppet-server-release.jar:na]
        at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:122) ~[puppet-server-release.jar:na]
        at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:164) ~[puppet-server-release.jar:na]
        at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:339) ~[puppet-server-release.jar:na]
        at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:317) ~[puppet-server-release.jar:na]
        at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:278) ~[puppet-server-release.jar:na]
        at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:106) ~[puppet-server-release.jar:na]
        at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:590) ~[puppet-server-release.jar:na]
        at java.lang.Thread.run(Thread.java:745) ~[na:1.8.0_65]
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ~[na:1.8.0_65]
        at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1728) ~[na:1.8.0_65]
        at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:304) ~[na:1.8.0_65]
        at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296) ~[na:1.8.0_65]
        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509) ~[na:1.8.0_65]
        at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) ~[na:1.8.0_65]
        at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979) ~[na:1.8.0_65]
        at sun.security.ssl.Handshaker$1.run(Handshaker.java:919) ~[na:1.8.0_65]
        at sun.security.ssl.Handshaker$1.run(Handshaker.java:916) ~[na:1.8.0_65]
        at java.security.AccessController.doPrivileged(Native Method) ~[na:1.8.0_65]
        at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1369) ~[na:1.8.0_65]
        at org.apache.http.nio.reactor.ssl.SSLIOSession.doRunTask(SSLIOSession.java:281) ~[puppet-server-release.jar:na]
        at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:351) ~[puppet-server-release.jar:na]
        ... 9 common frames omitted
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387) ~[na:1.8.0_65]
        at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292) ~[na:1.8.0_65]
        at sun.security.validator.Validator.validate(Validator.java:260) ~[na:1.8.0_65]
        at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) ~[na:1.8.0_65]
        at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:281) ~[na:1.8.0_65]
        at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136) ~[na:1.8.0_65]
        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496) ~[na:1.8.0_65]
        ... 17 common frames omitted
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:146) ~[na:1.8.0_65]
        at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:131) ~[na:1.8.0_65]
        at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) ~[na:1.8.0_65]
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382) ~[na:1.8.0_65]
        ... 23 common frames omitted

I have the default configuration in the jetty.ini :

# IP address or hostname to listen for clear-text HTTP. To avoid resolution
# issues, IP addresses are recommended over hostnames.
# Default is `localhost`.
# host = <host>

# Port to listen on for clear-text HTTP.
port = 8080

# The following are SSL specific settings. They can be configured
# automatically with the tool `puppetdb ssl-setup`, which is normally
# ran during package installation.

# IP address to listen on for HTTPS connections. Hostnames can also be used
# but are not recommended to avoid DNS resolution issues. To listen on all
# interfaces, use ``.
ssl-host =

# The port to listen on for HTTPS connections
ssl-port = 8081

# Private key path
ssl-key = /etc/puppetdb/ssl/private.pem

# Public certificate path
ssl-cert = /etc/puppetdb/ssl/public.pem

# Certificate authority path
ssl-ca-cert = /etc/puppetdb/ssl/ca.pem

Here is my puppetdb.conf on my 2nd master :

server_urls = https://puppetmaster01.domain.com:8081

When I launched the puppetdb ssl-setup the 1st time, it said it copied puppetmaster ssl (ca, private and public) from /etc/puppetlabs/puppet/ssl. So I tried to copy those from my master02 and add it to the 3 files specify in the jetty, but it didn't work.

Thanks for your help!

EDIT : I found a doc which tells I have to use CA cert. So I generated a CA cert with that command :

puppet cert generate puppetmaster01.domain.com --allow-dns-alt-names  --dns_alt_names=puppetmaster.domain.com,puppetmaster01.domain.com,puppetmaster02.domain.com

After I used this one to setup ssl for puppetdb :

puppetdb ssl-setup -f

1st problem : My master works, I copied the ssl/certs/ca.pem on my nodes in ssl/certs, they are able to generate a new SSL but my master never received it.

2nd problem : I copied all the SSL directory from my 1st master to the 2nd, I renamed SSL files with the good name but when I launch my puppet agent -t I get that :

Error: Could not retrieve catalog from remote server: Error 403 on SERVER: Forbidden request: puppetmaster01.domain.com(IP_MASTER_02) access to /puppet/v3/catalog/puppetmaster02.domain.com [find] authenticated  at :68
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run
Error: Could not send report: Error 403 on SERVER: Forbidden request: puppetmaster01.domain.com( access to /puppet/v3/report/puppetmaster02.domain.com [save] authenticated  at :78

It's like it tries to get information for master01 instead of 02...

| improve this question | | | | |

I found how to use the CA, you just have to take the repo puppet/ssl/ca and put it on your other servers and regenerate the SSL.

So on the 1st master you use : puppet cert generate puppetmaster01.domain.com --allow-dns-alt-names --dns_alt_names=puppetmaster.domain.com,puppetmaster01.domain.com,puppetmaster02.domain.com

Copy all the puppet/ssl/ca on your 2nd master and regenerate the ssl for this one : puppet cert generate puppetmaster02.domain.com

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.