I am trying to install and configure puppet 5.3.2 on two identical Linux machines running Centos 7 (one being a master and the other being an agent). I have managed to install the puppet from the official repository on both and added the following.

Master node in /etc/hosts                 <master hostname>
<master node ipaddress>   puppet, <master node hostname>
<agent node ipaddress>    <agent node hostname>

Agent node in /etc/hosts                 <agent hostname>
<master node ipaddress>   puppet, <master node hostname>
<agent node ipaddress>    <agent node hostname>

Master node in /etc/puppetlabs/puppet/puppet.conf

vardir = /opt/puppetlabs/server/data/puppetserver
logdir = /var/log/puppetlabs/puppetserver
rundir = /var/run/puppetlabs/puppetserver
pidfile = /var/run/puppetlabs/puppetserver/puppetserver.pid
codedir = /etc/puppetlabs/code
dns_alt_names = puppet, <master node hostname>
certname = puppet

Agent node in/etc/puppetlabs/puppet/puppet.conf

server = puppet, <master node hostname>

The puppet server starts successfully. However, I still need to generate and sign the appropriate certificates for both master and agent. For this firstly, I make sure the puppetserver is stopped on the puppet master node, and then on the puppet master node I issue:

sudo /opt/puppetlabs/bin/puppet cert list -a

I see a SHA256 certificate.

Now, I do not know how to proceed further. Any inputs would be highly appreciated.


I was able to get this working. Basically, when the puppet server is started initially, the certificate is generated and this can be viewed by

sudo /opt/puppetlabs/bin/puppet cert list -a

Next on the agent node, stop the puppet agent using the below if the agent is running (this can be found by systemctl status puppet

systemctl stop puppet

Create a certificate on the puppet agent which need to be signed by the puppet master. The certificate can be generated by:

/opt/puppetlabs/bin/puppet agent -t

On the master node, the agent certificate can be viewed by

/opt/puppetlabs/puppet cert list -a

The agent certificate should be signed now, for that

/opt/puppetlabs/puppet cert sign <puppet agent hostname>

Once the certificate is signed, this needs to be verified. However, before it is verified, the puppet agent should be up and running.

systemctl start puppet
systemctl enable puppet
/opt/puppetlabs/bin/puppet agent --fingerprint #certificate verification

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.