puppet cert clean unrevokes old revoked certs?

[Kostis Fardelas]

Hi,
I revoke a host cert:
puppet cert --revoke host1.example.com

I verify that the host1 cert was added to the crl, restarted puppetmaster and the client is indeed banned.

I clean another's host cert:
puppet cert --clean host2.example.com

I verify that host1 cert was REMOVED from crl and host2 cert was added to it.

Now host1 can run puppet and host2 cannot. Does this sound like a bug to you or a misconfiguration?

Regards,
Kostis

[jcbollinger]

It sounds like a bug to me.  Even if the issue could be traced back to configuration (which I doubt), under no circumstances should any configuration or misconfiguration lead to 'puppet cert' removing a cert from the CRL under any circumstances.


John