Foreman 1.19 > Puppet (5.5.6) > Centos 7: "certificate has expired for /CN=Puppet CA".

[JB SysAdmin]

All:
I bid you good fortune.

On inherited a Foreman 1.19 / Puppet (5.5.6) presence, the original, 5-year cert (CA) expired. I found out while trying to run puppet agent on a new node.
There was no complete documented series of steps for this combo of versions; the one who set up the presence departed a while back.

I followed a combination of what I saw:

On puppet master:

rm -rf /etc/puppetlabs/puppetdb/ssl
puppetserver ca generate --config /etc/puppetlabs/puppet/puppet.conf
puppet master --no-daemonize --verbose
puppet resource service puppetserver ensure=running
puppet resource service puppet ensure=running

/opt/puppetlabs/server/apps/puppetdb/bin/puppetdb ssl-setup -f
puppet resource service puppetdb ensure=running

But on the master itself, and certainly a separate client/agent, there are any number or errors.

* If on puppet master, running "puppet agent -t", I get this this error, where should I be checking?

Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=error: certificate verify failed: [self signed certificate in certificate chain for /CN=Puppet Root CA: *******]
Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet:///pluginfacts: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [self signed certificate in certificate chain for /CN=Puppet Root CA: ***]

* On puppet master, "systemctl status -l puppet" concludes in
"Unable to fetch my node definition, but the agent run will continue:"
"Sep 28 16:58:42 <hostname> puppet-agent[19623]: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [self signed certificate in certificate chain for /CN=Puppet Root CA: ********]"
"Could not send report: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [self signed certificate in certificate chain for /CN=Puppet Root CA: ******]"

* If I run the same on any client, with below result, where should I head?

Warning: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get issuer certificate for /CN=Puppet CA: <hostname>]
Info: Retrieving pluginfacts
Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 s
tate=error: certificate verify failed: [unable to get issuer certificate for /CN=Puppet CA: <hostname>]
Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet:///pluginfacts: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get issuer certificate for /CN=Puppet CA: <hostname>]

Any leads on next steps would be appreciated. (I do realize the software versions cited are rather old.)

[Andreas Ntaflos]

On 28.09.22 23:52, JB SysAdmin wrote:
> I followed a combination of what I saw:
>
> On puppet master:
>
> rm -rf /etc/puppetlabs/puppetdb/ssl
> puppetserver ca generate --config /etc/puppetlabs/puppet/puppet.conf
> puppet master --no-daemonize --verbose
> puppet resource service puppetserver ensure=running
> puppet resource service puppet ensure=running

From your descriptions it doesn't look like you actually restarted
Puppetserver after regenerating the CA, so maybe try that first:
"systemctl restart puppetserver" (as root).

> /opt/puppetlabs/server/apps/puppetdb/bin/puppetdb ssl-setup -f
> puppet resource service puppetdb ensure=running

Similarly restart PuppetDB, "systemctl restart puppetdb".

The "puppet resource ... ensure=running" commands don't restart any
service. They would just start a service if it wasn't running.

> But on the master itself, and certainly a separate client/agent, there
> are any number or errors.

Not sure if you did that already, but when regenerating the CA, as you
have done, you'll need to issue new certificates to all Puppet agent nodes.

On a Puppet agent node:

rm -rf /etc/puppetlabs/puppet/ssl
puppet agent -t --waitforcert 30

On the Puppetmaster (= Puppet CA server):

puppetserver ca list
puppetserver ca sign --certname <NODE_CERTNAME>

Do that for all Puppet agent nodes.

HTH,

Andreas

[JB SysAdmin]

Thanks so much for answering! I certainly restarted puppet and puppetdb services (using systemctl). Restarted the node, as well. The issue is that something is still missing/conflicting on the master. Running puppet agent on the master itself fails. Indeed, today, as this was linked with Foreman 1.19, I re-traced using this reference: https://alexshepherd.me/posts/changing-foremans-ssl-certificate/

* "server_ssl_cert" (/etc/foreman-installer/scenarios.d/foreman-answers.yaml) does already match SSLCertificateFile (/etc/httpd/conf.d/05-foreman-ssl.conf)
* "server_ssl_chain" from above is one of the files generated from the recent puppet action (puppetserver ca generate --config) It does match "SSLCertificateChainFile" on the latter SSL conf.
* "server_ssl_key" (/etc/foreman-installer/scenarios.d/foreman-answers.yaml) already matches SSLCertificateKeyFile (/etc/httpd/conf.d/05-foreman-ssl.conf)
* "puppet_ssl_ca" /etc/puppetlabs/puppet/ssl/certs/ca.pem; that matches "server_ssl_chain" /etc/puppetlabs/puppet/ssl/certs/ca.pem
But it does NOT match "server_ssl_chain_filepath" (/etc/puppetlabs/puppet/ssl/ca/ca_crt.pem) I don't know if that matters; It is present in the foreman-answers.yaml.

There are newly generated items in all those places, but I can't figure out what remains broken...

[JB SysAdmin]

Also, the "puppetserver ca list" returns errors. Excerpt:

/opt/puppetlabs/puppet/lib/ruby/2.4.0/net/protocol.rb:44:in `connect_nonblock': SSL_connect returned=1 errno=0 state=error: certificate verify failed (OpenSSL::SSL::SSLError)
        from /opt/puppetlabs/puppet/lib/ruby/2.4.0/net/protocol.rb:44:in `ssl_socket_connect'
        from /opt/puppetlabs/puppet/lib/ruby/2.4.0/net/http.rb:948:in `connect'
        from /opt/puppetlabs/puppet/lib/ruby/2.4.0/net/http.rb:887:in `do_start'
        from /opt/puppetlabs/puppet/lib/ruby/2.4.0/net/http.rb:876:in `start'
        from /opt/puppetlabs/puppet/lib/ruby/2.4.0/net/http.rb:608:in `start'

--
You received this message because you are subscribed to a topic in the Google Groups "Puppet Users" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/puppet-users/LNbSFcwUq3g/unsubscribe.
To unsubscribe from this group and all its topics, send an email to puppet-users...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/e00f30b4-bb97-42df-ada6-f852361e303dn%40googlegroups.com.