Puppet: Trying to configure puppet client for first use but got some problems with certificates

Question

I'm trying to configure my clinet 'Itai-test' to receive puppet settings from the puppet server which is called 'puppetmaster'.

On the server I ran:

[root@puppetmaster requests]# puppet cert --generate itai-test.domain
Error: A Certificate already exists for itai-test.domain
[root@puppetmaster requests]# puppet cert --sign itai-test.domain
Error: Could not find certificate request for itai-test.domain
[root@puppetmaster requests]#

On the puppet client I ran:

[root@itai-test temp]# puppet agent --server puppetmaster.domain --waitforcert 60 --test
Notice: Did not receive certificate
Notice: Did not receive certificate
Notice: Did not receive certificate

More information: On server:

[root@puppetmaster ~]# puppet cert --revoke Itai-test
Error: Could not find a serial number for itai-test
[root@puppetmaster ~]# puppet cert --revoke itai-test
Error: Could not find a serial number for itai-test
[root@puppetmaster ~]# puppet cert --clean itai-test
Error: Could not find a serial number for itai-test
[root@puppetmaster ~]# puppet cert --list
[root@puppetmaster ~]# puppet cert --sign itai-test
Error: Could not find certificate request for itai-test
[root@puppetmaster ~]#

On client:

[root@itai-test ~]# rm -rf /usr/lib/puppet/ssl
[root@itai-test ~]# puppet agent --server puppetmaster.domain --waitforcert 60
[root@itai-test ~]# ping puppetmaster.domain
PING puppetmaster (192.168.X.X) 56(84) bytes of data.
64 bytes from puppetmaster (192.168.X.X): icmp_seq=1 ttl=64 time=0.294 ms

score 12 · Accepted Answer · answered Feb 24 '14 at 14:03

12

Does you client know how to find the server?

root@client# ping puppet

What certname will the client use when connecting to the server?

root@client# puppet config print certname

Remove the ssl details on the client

root@client# rm -rf /var/lib/puppet/ssl

Remove all traces of the client on the server

root@puppet# puppet node clean $client_certname
root@puppet# puppet node deactivate $client_certname

answered Feb 24 '14 at 14:03

ptman

27,124
2
26
45

1

Thanks for "puppet config print certname" -- very useful and I hadn't seen that before. – richardkmiller Oct 02 '14 at 01:19
1

Thanks. Somehow the certname was not matching with my hostname, I fixed it by setting [certname in puppet.conf](https://docs.puppetlabs.com/puppet/latest/reference/config_about_settings.html) – the Nov 03 '14 at 12:16
Docs have moved. See [certname in puppet.conf](https://puppet.com/docs/puppet/5.5/configuration.html#certname) instead. – nomadic_squirrel Apr 26 '18 at 16:06

score 3 · Answer 2 · answered Feb 20 '14 at 19:52

3

First: On Server

puppet cert --revoke Itai-test
puppet cert --clean Itai-test

Second: On Client

rm -rf /usr/lib/puppet/ssl
puppet agent --server [puppetmaster domain name] --waitforcert 60

Third: On Server

puppet cert --list (you should see your host)
puppet cert --sign Itai-test

Also, double check that your client can reach your [puppetmaster domain name].

answered Feb 20 '14 at 19:52

mrpatrick

31
2

I've edited my question with the results of the commands you mentioned, thanks. – Itai Ganot Feb 24 '14 at 13:54

score 1 · Answer 3 · answered Feb 12 '14 at 12:38

1

I think you got out of sync somehow. Assuming this is really just a test instance... On the server, run puppet node clean itai-test.domain. Then, on the client run rm -rf /var/lib/puppet/ssl. Now your SSL cert for the client is gone. Run puppet agent --server puppetmaster.domain --waitforcert 60 --test on the client and look for the certificate request on the server.

answered Feb 12 '14 at 12:38

Bill Weiss

10,782
3
37
65

I had the same problem as the op, and this finally worked for me. – slec Jan 27 '16 at 19:24

Puppet: Trying to configure puppet client for first use but got some problems with certificates

3 Answers3