Jira (PUP-8889) Puppet Agent : cannot add certificates for HTTPS

Branan Riley (JIRA)

unread,

May 24, 2018, 4:32:03 PM5/24/18

to puppe...@googlegroups.com

Branan Riley moved an issue

Puppet /

PUP-8889

Puppet Agent : cannot add certificates for HTTPS

Change By:	Branan Riley
Affects Version/s:	puppet-agent 5.5.1
Affects Version/s:	puppet-agent 1.10.9
Affects Version/s:	PUP 4.10.9
Affects Version/s:	PUP 5.5.1
Key:	PA PUP - 2059 8889
Project:	Puppet Agent

Add Comment

This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)

Craig Gomes (JIRA)

unread,

May 29, 2018, 12:44:03 PM5/29/18

to puppe...@googlegroups.com

Craig Gomes updated an issue

Puppet /

PUP-8889

Puppet Agent : cannot add certificates for HTTPS

Change By:	Craig Gomes
Team:	Coremunity

Add Comment

Thomas Mueller (JIRA)

unread,

Jun 6, 2018, 7:24:02 AM6/6/18

to puppe...@googlegroups.com

Thomas Mueller commented on

PUP-8889

Re: Puppet Agent : cannot add certificates for HTTPS

Franck Jouvanceau 08fa37bb.0 is some hash id of the CA cert. this is an OpenSSL thing.

after putting a cert into the directory with a human-readable filename you'll need to run c_rehash /opt/puppetlabs/puppet/ssl/certs/ (https://www.openssl.org/docs/man1.0.2/apps/c_rehash.html) to create hash symlinks.

Add Comment

Franck Jouvanceau (JIRA)

unread,

Jun 6, 2018, 8:05:02 AM6/6/18

to puppe...@googlegroups.com

Franck Jouvanceau commented on

PUP-8889

Re: Puppet Agent : cannot add certificates for HTTPS

Ok, thanks a lot for the information.

yes, we are using /etc/pki/ca-trust/source/anchors

ok we'll do something like :

file { '/opt/puppetlabs/puppet/ssl/certs':

  ensure  => 'directory',

  source  => '/etc/pki/ca-trust/source/anchors',

  recurse => true,

~> exec { 'rehash puppetlabs certs':

  command     => '/opt/puppetlabs/puppet/bin/c_rehash /opt/puppetlabs/puppet/ssl/certs',

  refreshonly => true,

Add Comment

Franck Jouvanceau (JIRA)

unread,

Jun 6, 2018, 9:32:02 AM6/6/18

to puppe...@googlegroups.com

Franck Jouvanceau commented on

PUP-8889

Re: Puppet Agent : cannot add certificates for HTTPS

Thomas Mueller thanks again, tested everything is fine, this issue can be closed

Add Comment

Thomas Mueller (JIRA)

unread,

Jun 6, 2018, 8:43:00 PM6/6/18

to puppe...@googlegroups.com

Thomas Mueller commented on

PUP-8889

Re: Puppet Agent : cannot add certificates for HTTPS

just FYI: on EL (RHEL/CentOS) and Fedora System CA trust certs in PEM format is managed in /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem (by the update-ca-trust utility). There's also a java keystore: /etc/pki/ca-trust/extracted/java/cacerts

If I wan't to add a custom/enterprise cert for my systems I'll add it to /etc/pki/ca-trust/source/anchors/ and after executing update-ca-trust system cert bundles contain my certs and wget/curl/openjdk will accept my TLS connections - but not puppet, because of its own openssl libs.