After installing puppet server on a puppet agent, I keep getting this error on the next puppet run.
Error: The CRL issued by 'CN=Puppet CA: puppet.aws.domain.com' is missing
Error: The CRL issued by 'CN=Puppet CA: puppet.aws.domain.com' is missing
It seems to be that the puppet server removes the issued CRL from the main puppet server. Regenerating another certificate does work however if the new puppet server ever restarts it will delete the issued CRL again.
My question now is: Is it possible to keep the issued CRL when I make a puppet agent to a puppet server?
Related
I have a on-prem gitlab where I am trying to run some builds/pipeline but getting the below error -
fatal: unable to access 'https://gitlab-ci-token:[MASKED]#gitlab.systems/testing/test-project-poc.git/': Peer's certificate issuer has been marked as not trusted by the user.
I have already looked into this - Gitlab:Peer's Certificate issuer is not recognized and followed the steps of obtaining the .pem file by merging the server certificate, intermediate certificate and root certificate but I am still getting the below error and really struggling to find the root cause.
/etc/gitlab/gitlab.rb config
##! enable/disable 2-way SSL client authentication
#nginx['ssl_verify_client'] = "off"
##! if ssl_verify_client on, verification depth in the client certificates chain
#nginx['ssl_verify_depth'] = "1"
nginx['ssl_certificate'] = "/etc/gitlab/ssl/gitlab.systems.pem"
nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/gitlab.systems.key"
Is there any other configuration which i need to update/modify? Any guidance is really appreciated.
I am guessing you are using a self signed certificate. If that is the case you have two options to rectify this issue:
Recommended option: Here again I assume that you have already solved the issue between the gitlab-runner and gitlab itseld, hence you registered the runner successfully. So you have already the certificate file in a /etc/gitlab-runner/certs. So on the server hosting the gitlab-runner, run the below command:
git config --system http.sslCAInfo /etc/gitlab-runner/certs/CERITIFICATE_NAME.crt
This is unsafe: Here you just disable the git https certificate verification:
git config --system http.sslverify false
I have Puppet master and Puppet agent, and the agent succeed to communicate with the master. Now I want to use other machine as my Puppet master. I create another Puppet master, called master-2, and run in the agent:
sudo puppet agent -t --server master-2
that cause to error:
certificate verify failed: [self signed certificate in certificate
chain for /CN=Puppet CA: master-2]
I copied the folder /var/lib/puppet/ssl from master to master-2, and now the above command succeeded.
Is there a way to prevent an agent communication with the first master? How I can remove the first master certificates from the agent and add a new certificates of master-2?
Create new clean master-2, and copy two files from master-2 to agent:
Copy file "/var/lib/puppet/ssl/ca/ca_crt.pem" from master-2 to agent, and save it as "/var/lib/puppet/ssl/certs/ca.pem".
Copy file "/var/lib/puppet/ssl/ca/ca_crl.pem" from master-2 to agent, ans save it as "/var/lib/puppet/ssl/crl.pem".
Delete old certificates in agent:
sudo find /var/lib/puppet/ssl -name <hostname>.pem -delete
Step 1 : Edit your agent's puppet.conf and add the new puppet master details in the [agent] section like below
[agent]
server=
Step 2 (optional) : If you are not copying the masters ssl certificate folder (/var/lib/puppet/ssl) , your agnet will now try to contact the server master2 and request a new certificate .You can sign the new certificate in your CA server using
puppet cert sign
command
I am creating a autorization token in puppet to setup code manager config in puppet master. On executing command and on putting login user and password
"puppet-access login --service-url https://10.20.1.4:4433/rbac-api --lifetime 365"
I got the error below
"Unable to reach the RBAC server at https://10.20.1.4:4433/rbac-api/v1/auth/token due to the following error: SSL peer certificate or SSH remote key was not OK."
could any one please help on it.
Thanks
I was connecting puppet with the wrong URL. the certificate was on hostname, rather then on the IP. I changed the url to https://MYHOSTNAME:4433/rbac-api and it worked.
Thanks
I am trying to setup puppet master and puppet agent in aws ec2 instances-linux ami. when i run my puppet agent to generate the certificate for the master to sign i encounter the below error.
Puppet Master:
[root#ip-10-**-*-*** /]# sudo yum install puppet-server
[root#ip-10-**-*-*** /] sudo service puppetmaster start
Starting puppetmaster: [ OK ]
Puppet Agent:
[root#ip-10-**-*-*** /]# sudo yum install puppet
[root#ip-10-**-*-*** /]
File excerpt /etc/puppet/puppet.conf
[main]
server = hostname
[root#ip-10-**-*-*** /] sudo service puppet start
Starting puppet: [ OK ]
[root#ip-10-**-*-*** /]# puppet agent -t
info: Creating a new SSL key for ip-10-**-*-***.dev.abc.net
info: Caching certificate for ca
info: Creating a new SSL certificate request for ip-10-**-*-***.dev.abc.net
info: Certificate Request fingerprint (md5): C2:F0:B1:2C:19:39:9E:D6:39:24:18:28
Exiting; no certificate found and waitforcert is disabled
Puppet Master:
[root#ip-10-**-*-*** /]# puppet cert list
"ip-10-**-*-***.dev.abc.net" (C2:F0:B1:2C:19:39:9E:D6:39:24:18:28:F6:DA:5D:FE)
[root#ip-10-**-*-*** /]# puppet cert sign ip-10-**-*-***.dev.abc.net
notice: Signed certificate request for ip-10-**-*-***.dev.abc.net
notice: Removing file Puppet::SSL::CertificateRequest ip-10-**-*-***.dev.abc.net at '/var/lib/puppet/ssl/ca/requests/ip-10-**-*-***.dev.abc.net.pem'
Puppet Agent:
[root#ip-10-**-*-*** /]# puppet agent -t
info: Caching certificate for ip-10-**-*-***.dev.abc.net
err: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [certificate signature failure for /CN=ip-10-**-*-***.dev.abc.net]
warning: Not using cache on failed catalog
err: Could not retrieve catalog; skipping run
err: Could not send report: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [certificate signature failure for /CN=ip-10-**-*-***.dev.abc.net]
Can anyone please help me resolve this issue.
Yes, I know this is an old post. It still needs an answer, as I am having the same issue -- been working it for a few weeks now. I cannot guarantee yet that mine is working correctly all the time. Here are some steps I have taken. I hope they are helpful to others.
I am running Puppet Enterprise 2018.1.4. Puppet Agent 5.5.6 on RHEL 7.4.
1) The SSL routine uses a time stamp. Ensure the time is the same between Master & Client.
2) clean/remove the agent cert from the Master AND the Client. On my RHEL, the Client cert is is in /etc/puppetlabs/puppet/ssl/* -- remove any files with the agent name in here.
3) Make sure your puppet enabled on your agent: puppet agent --enable
4) If a client does not contact the puppet master "for a while" the master will drop the client from it's node list, but NOT remove the cert. In theory, the master SHOULD return the node to an active status.
5) Can you run the puppet agent on the master & get the expected results? If not -> problem with puppet code, otherwise, problem with agent.
6) Is puppet.conf configured correctly? Under the [main] section, do you have the server entry correct? Under [agent] are you set to the correct environment? Is noop set to true?
7) It is possible that you have an error in a puppet module that is causeing the agent to exit quietly. Run puppet parser validate on all of your .pp files
8) Can the master resolve the IP address of the master and the client? Can the client resolve the the IP address of the master and the client? Is resolv.conf set correctly on both hosts?
9) hostnames of the client & master should be correct. Each server should know it's shortname, FQDN and IP. On RHEL, I run: hostname; hostname -f; and hostname -i, respectively.
10) File permissions on all the directories & modules should be correct. Check out a working module, see it's owner, group & permissions. Ensure your module is the same.
11) Only root/admin can correctly run puppet agent.
12) On RHEL, the logs are under /var/log/puppet. Do you see any errors there?
13) run puppet agent with the --debug or the --trace option in addition to -t. Pipe this output to a file and see if you can spot any errors.
14) Can you force the master to run the puppet agent on the client successfully?
Many of these things have been narrowing down my issue. I don't know yet if it is fixed, as It takes a while for a node to drop out. Hopefully these will fix your issue.
I am trying to get my hands with puppet. I boot up 2 VM both running on linuxmint 17. I intended one as puppetmaster and one as puppetclient. I am follow this guide https://help.ubuntu.com/12.04/serverguide/puppet.html
in /etc/hostname
in /etc/hosts
master:
127.0.0.1 localhost /// no chance
127.0.1.1 puppetmaster //
192.168.75.141 puppetclient //this client's ip address after nm-tool search.
client:
127.0.0.1 localhost
127.0.1.1 puppetclient
192.168.75.142 puppetmaster // this is the master's ip address
In both client and master I created a file in etc/puppet/manifests/site.pp
package {
'apache2':
ensure => installed
}
service {
'apache2':
ensure => true,
enable => true,
require => Package['apache2']
}
In master I created a file in /etc/puppet/manifests/nodes.pp
node 'meercat02.example.com' {
include apache2
}
In client I create a file /etc/default/puppet and put START=yes.
Here's what I think there's a problem. In the guide, the file should already exist but in my case I have to create it.
So then I followed everything in the guide to sign the client certificate. I typed in sudo puppetca --sign puppetclient in puppetmaster's terminal . That didn't work and I found the solution in another post. https://serverfault.com/questions/457349/installed-puppetmaster-but-why-do-i-get-puppetca-command-not-found. So after reading the post I typed sudo puppet cert list --sign 'puppetclient'. Then it gives me this
Notice: Signed certificate request for ca
Error: Could not find certificates request for list
After the first five pages of google search I end up here asking for help. =) Anyone can help me resolve this issue? Thanks.
You cannot sign a certificate before there is a certificate request.
You have to establish the agent/master communication first.
Find out the certificate name of your master
puppet master --configprint certname
On the agent node, make sure that name resolves to the master's IP address (you currently used puppetmaster for this, which might suffice).
Send the initial request to the master
Do this on the agent node.
puppet agent --test --master=<name you just registered>
The agent generates a CSR, and prints a message that it could not receive a certificate.
Sign the certificate
On the master:
puppet cert list
Locate the CSR of your agent, then
puppet cert sign <agent>
The next puppet agent --test call will receive the certificate.
Try this
puppet agent --test master="name you just register"
its work for me.