On 28.09.22 23:52, JB SysAdmin wrote:
> I followed a combination of what I saw:
>
> On puppet master:
>
> rm -rf /etc/puppetlabs/puppetdb/ssl
> puppetserver ca generate --config /etc/puppetlabs/puppet/puppet.conf
> puppet master --no-daemonize --verbose
> puppet resource service puppetserver ensure=running
> puppet resource service puppet ensure=running
From your descriptions it doesn't look like you actually restarted
Puppetserver after regenerating the CA, so maybe try that first:
"systemctl restart puppetserver" (as root).
> /opt/puppetlabs/server/apps/puppetdb/bin/puppetdb ssl-setup -f
> puppet resource service puppetdb ensure=running
Similarly restart PuppetDB, "systemctl restart puppetdb".
The "puppet resource ... ensure=running" commands don't restart any
service. They would just start a service if it wasn't running.
> But on the master itself, and certainly a separate client/agent, there
> are any number or errors.
Not sure if you did that already, but when regenerating the CA, as you
have done, you'll need to issue new certificates to all Puppet agent nodes.
On a Puppet agent node:
rm -rf /etc/puppetlabs/puppet/ssl
puppet agent -t --waitforcert 30
On the Puppetmaster (= Puppet CA server):
puppetserver ca list
puppetserver ca sign --certname <NODE_CERTNAME>
Do that for all Puppet agent nodes.
HTH,
Andreas