Jira (PUP-10159) Can't differentiate between cert and request on Puppet Server

[Mihai Buzgau (JIRA)]

Mihai Buzgau moved an issue

Puppet / PUP-10159 Can't differentiate between cert and request on Puppet Server Change By: Mihai Buzgau Key: PA PUP - 3017 10159 Project: Puppet Agent Add Comment

This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)

[Mihai Buzgau (JIRA)]

Mihai Buzgau commented on PUP-10159

Re: Can't differentiate between cert and request on Puppet Server Not sure if this is a PUP, Server or PE Console ticket. /cc Josh Cooper Maggie Dreyer We will try to do some digging into it.

Add Comment

[Josh Cooper (JIRA)]

Josh Cooper commented on PUP-10159

Re: Can't differentiate between cert and request on Puppet Server

The puppet cert command is deprecated in 5.5.x and removed in 6. In 5.5.x there should be a leading +. $ bx puppet cert list --all Warning: `puppet cert` is deprecated and will be removed in a future release. (location: /Users/josh/work/puppet/lib/puppet/application.rb:370:in `run') + "foobar" (SHA256) B7:42:13:1D:2E:D9:16:07:88:CD:42:40:19:34:20:15:F2:3D:D0:E0:09:28:1B:5D:86:B3:38:27:F2:D4:A1:83 The replacement in Puppet 6 is puppetserver ca list. Most likely this can be closed.

Add Comment

[Josh Cooper (JIRA)]

Josh Cooper updated an issue

Puppet / PUP-10159

Can't differentiate between cert and request on Puppet Server

Change By: Josh Cooper Team: Server

Add Comment

[Jonny (JT) Tripathy (JIRA)]

Jonny (JT) Tripathy commented on PUP-10159

Re: Can't differentiate between cert and request on Puppet Server Hey Josh, Thanks for the information. We are not seeing the '+' sign for a cert request. Please see the attached 2 new screenshots for a test "test.jt" cert request. Thanks JT

Add Comment

[Jonny (JT) Tripathy (JIRA)]

Jonny (JT) Tripathy updated an issue

Puppet / PUP-10159

Can't differentiate between cert and request on Puppet Server

Change By: Jonny (JT) Tripathy Attachment: Screen Shot 2019-12-11 at 15.23.56.png Attachment: Screen Shot 2019-12-11 at 15.24.59.png

Add Comment

[Jonny (JT) Tripathy (JIRA)]

Jonny (JT) Tripathy assigned an issue to Josh Cooper

Puppet / PUP-10159 Can't differentiate between cert and request on Puppet Server

Change By: Jonny (JT) Tripathy

Assignee: Josh Cooper

Add Comment

[Maggie Dreyer (JIRA)]

Maggie Dreyer commented on PUP-10159

Re: Can't differentiate between cert and request on Puppet Server In puppetserver ca, there are section markers diving CSRs from signed certs from revoked certs. I'm now realizing that this interacts badly with grep. Run the command without the grep to see what I mean.

Add Comment

[Justin Stoller (JIRA)]

Justin Stoller commented on PUP-10159

Re: Can't differentiate between cert and request on Puppet Server

I think this is captured in SERVER-2252 but is a good point to prioritizing that work.

Add Comment

[Maggie Dreyer (JIRA)]

Maggie Dreyer commented on PUP-10159

Re: Can't differentiate between cert and request on Puppet Server

Interestingly, I'm seeing - for both signed and revoked certs (though this could be due to issues with my dev environment), and nothing for CSRs. https://github.com/puppetlabs/puppet/blob/5.5.x/lib/puppet/ssl/certificate_authority/interface.rb#L11 would seem to me to indicate that we expect no leading symbol for CSRs, but a + for signed certs.

Add Comment

[Maggie Dreyer (JIRA)]

Maggie Dreyer updated an issue

Puppet / PUP-10159

Can't differentiate between cert and request on Puppet Server

Change By: Maggie Dreyer Team: Froyo

Add Comment

[Maggie Dreyer (JIRA)]

[Maggie Dreyer (JIRA)]

Maggie Dreyer assigned an issue to Unassigned

Puppet / PUP-10159 Can't differentiate between cert and request on Puppet Server

Change By: Maggie Dreyer Assignee: Josh Cooper

Add Comment

[Josh Cooper (Jira)]

Josh Cooper commented on PUP-10159

Re: Can't differentiate between cert and request on Puppet Server Ah I was mistaken earlier. It looks like puppet cert list returns + for signed certs (untidy-keeping.delivery.puppetlabs.net), - for revoked certs (neptune) and no leading symbol for CSR (testing) as Maggie Dreyer said: # puppet --version 5.5.22 # puppet cert list --all

Warning: `puppet cert` is deprecated and will be removed in a future release.

(location: /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/application.rb:370:in `run') "testing" (SHA256) 07:7A:FB:52:13:24:C3:03:08:25:97:7F:58:34:69:8F:B1:5C:14:3F:D0:55:44:E5:64:81:CE:BA:6E:09:60:37 + "untidy-keeping.delivery.puppetlabs.net" (SHA256) 69:32:38:B1:1C:21:E9:ED:4B:E3:C5:96:3D:96:DA:01:FC:EF:BA:EE:A9:98:AF:8D:98:9F:49:A5:13:C6:87:37 (alt names: "DNS:puppet", "DNS:untidy-keeping.delivery.puppetlabs.net") ** - "neptune" (SHA256) 27:66:2A:7C:F9:DC:59:3A:4D:6B:6A:67:72:9E:35:E7:A3:98:85:8F:91:B6:A7:99:98:21:DC:9A:6E:E2:BA:22 (certificate revoked) Adding that information to the puppetserver ca command is filed as SERVER-2252. And the puppet cert command was removed in puppet 7, so I think the remaining issue is the PE console doesn't make the same distinction in the PE UI? So I'll move this ticket to the PE project.

Add Comment

This message was sent by Atlassian Jira (v8.5.2#805002-sha1:a66f935)