PKIX path validation failed

[Bret Wortman]

I'm standing up a new replacement puppet server in place of the one we trashed a few weeks ago, and am running into a new, interesting issue.

I'm running puppet and puppetdb on the same server. Postgres is up and running. When I try to run puppet agent -t on a random system, I get this:

# puppet agent -t

Warning: Unable to fetch my node definition, but the agent run will continue

:

Info: Retrieving pluginfacts

Info:Retrieving plugin

Info: Loading facts

Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: Failed to execute '/pdb/cmd/v1?checksum=<blah>&version=5&certname=zw129.my.net&command=replace_fact&producer-timestamp=<blah>' on at least 1 of the following 'server_urls': https://puppet.my.net:8081

Warning: Not using cache on failed catalog

Error: Could not retrieve catalog: skipping run

#

So I peeked in /var/log/puppetlabs/puppetserver/puppetserver.log and found:

ERROR [qtp6662638830-70] [c.p.h.c.i.PersistentSyncHttpClient] Error executing http request

javax.net.ssl.SSLHandshakeException: General SSLEngine problem

:

Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem

:

Caused by: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors

:

So I'm thinking something in the certificate chain is wrong, but I'm hesitant to dive in and start replacing certs without being pretty sure of what I'm doing, lest we end up starting over yet again. Has anyone else encountered anything like this?

Thanks!

Bret

[Thomas Müller]

Sounds like maybe multiple issues:

* if an ENC is configured the ENC request maybe failed

* puppetdb does not use certs that are signed by the puppetserver CA

I would start by checking puppetdb certs.

- Thomas

[Bret Wortman]

Here's how I recovered:

# service puppetdb stop

# yum remove puppetdb

# cd /etc/puppetlabs

# mv puppetdb puppetdb.orig

# puppet apply puppetdb.pp

# service puppetserver stop && service puppetserver start

And we appear to be better off now. Note that puppetdb.pp was a one-shot manifest I wrote to just install puppetdb. I suspect that I somehow changed the puppetserver certs after installing puppetdb originally, and reapplying the manifest without removing the older /etc/puppetlabs/puppetdb directory prevented it from generating new certs.

[warron.french]

If you execute on the puppetmaster itself, the following command:

puppet cert list -all  | egrep -i    'zw129.my.net' is the certificate listed?

If not, I would say that's the first problem you need to resolve.  Or am I missing something?

--------------------------
Warron French

--
You received this message because you are subscribed to the Google Groups "Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users+unsubscribe@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/d51e334f-17c5-4546-9b25-264d80885a74%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.