Jira (PDB-4643) unable to connect puppetmaster with puppetdb

unable to connect puppetmaster with puppetdb

Issue Type:	Bug
Affects Versions:	PDB 6.8.1
Assignee:	Unassigned
Components:	PuppetDB
Created:	2020/02/04 9:23 AM
Priority:	Normal
Reporter:	Jens

Puppet Version: puppet-agent-6.12.0-1.el8.x86_64
Puppet Server Version: puppetserver-6.8.0-1.el8.noarch
OS Name/Version: CentOS 8 4.18.0-147.3.1.el8_1.x86_64

Hello folks, I am in the migration from an old puppetserver host to a new machine.

Unfortunately I am unable to use the puppetdb, as the puppetserver throws an ssl related error.

I even started from scratch for now (new ca certs, new puppetdb certs, all created with default commands)

Desired Behavior: puppetserver stores the results in puppetdb

Actual Behavior:

error message in puppetserver.log:

8<---Error executing http request

javax.net.ssl.SSLHandshakeException: DHPublicKey does not comply to algorithm constraints

[puppetserver] Puppet Error connecting to <SERVER> on 8081 ...

8<---

I found that puppet is using a 2048 DHParam for the cert authority, and CentOS 8 should accept such generated certificates, even after RedHat set more secure standards with RHEL8.

So I am not sure If I should blame puppet or centos and how to find a solution.

Thanks in Advance

Jens

This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)

Jens (JIRA)

unread,

Feb 7, 2020, 8:30:06 AM2/7/20

to puppe...@googlegroups.com

Jens commented on

Hello,

I always got the "javax.net.ssl.SSLHandshakeException: DHPublicKey does not comply to algorithm constraints" in the puppetserver.log

I was able to get it working by executing "update-crypto-policies --set LEGACY", which lowered the security level, allowing weaker ciphers...

Stefan (Jira)

unread,

Apr 6, 2020, 10:53:03 AM4/6/20

to puppe...@googlegroups.com

Stefan commented on

FWIW switching to java 11 solved the problem for me:

dnf install java-11-openjdk-headless

update-alternatives --config java

And selecting "java-11-openjdk.x86_64", then restart puppetdb and puppetserver.

This message was sent by Atlassian Jira (v8.5.2#805002-sha1:a66f935)

Austin Blatt (Jira)

unread,

Jun 2, 2020, 2:23:03 PM6/2/20

to puppe...@googlegroups.com

Austin Blatt commented on

To get this working in Java 8, you'll need to add the following java arg -Djdk.tls.ephemeralDHKeySize=2048

Stefan (Jira)

unread,

Jul 8, 2020, 11:22:04 AM7/8/20

to puppe...@googlegroups.com

Stefan commented on

FWIW, puppet lookup --node ... only works for me when -Djdk.tls.ephemeralDHKeySize=2048 is set, even with java-11.

Valters Jansons (Jira)

unread,

Feb 10, 2021, 1:20:03 PM2/10/21

to puppe...@googlegroups.com

Valters Jansons commented on

Is there a reason as to why the packaged /etc/default/puppetdb for Open-Source PuppetDB does not include -Djdk.tls.ephemeralDHKeySize=2048?

Austin Blatt (Jira)

unread,

Feb 10, 2021, 1:27:03 PM2/10/21

to puppe...@googlegroups.com

Austin Blatt commented on

Java 11 should choose a key size of 2048, which should work for puppetdb 7.1.0. Are you having the same puppet lookup --node issue using java 11 or a different issue?