How to fix puppet certificate errors

Posted on by Ebin

When we recently took over some client’s infrastructure, we started to get the following error.

puppet-cert-error

I just had to renew the cert to fix this. To renew, follow the steps below:

1.Delete the old certificate from client.

root@agent1:/etc/puppetlabs/puppet# mv ssl ssl.20171115

2.Delete the old certificate from server.

root@ip-172-31-7-177:/home/ubuntu# puppet cert clean agent1.ap-southeast-1.compute.internal   //make sure to change the agent name

3.Run puppet agent again, it will create a new certificate.

root@agent1:/etc/puppetlabs/puppet# puppet agent -tv
Info: Creating a new SSL key for agent1.ap-southeast-1.compute.internal
Info: Caching certificate for ca
Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for agent1.ap-southeast-1.compute.internal
Info: Certificate Request fingerprint (SHA256): 16:E8:E6:51:46:A1:07:0E:FA:E1:E9:F9:54:C4:4E:F7:F9:EF:0E:xx:xx:xx:xx:xx:xx
Info: Caching certificate for ca
Exiting; no certificate found and waitforcert is disabled
root@agent1:/etc/puppetlabs/puppet#

4.If we get the following message, that means puppet server auto sign is not enabled, so we need to manually sign the cert from server. If it is not there, move to step 7

Exiting; no certificate found and waitforcert is disabled

5.To manually sign, first list the certs to be signed in the master.

root@ip-172-31-7-177:/home/ubuntu# puppet cert --list
"agent1.ap-southeast-1.compute.internal" (SHA256) 16:E8:E6:51:46:A1:07:0E:FA:E1:E9:F9:54:C4:4E:F7:F9:EF:0E:xx:xx:xx:xx:xx:xx
"agent2.ap-southeast-1.compute.internal" (SHA256) B1:3F:AF:A5:70:90:33:60:B8:63:EF:2C:A5:97:72:2C:DD:EF:xx:xx:xx:xx:xx:xx:xx
root@ip-172-31-7-177:/home/ubuntu#

6.Sign the certificate for that agent by :

root@ip-172-31-7-177:/home/ubuntu# puppet cert sign agent1.ap-southeast-1.compute.internal
Signing Certificate Request for:
"agent1.ap-southeast-1.compute.internal" (SHA256) 16:E8:E6:51:46:A1:07:0E:FA:E1:E9:F9:54:C4:4E:F7:F9:EF:xx:xx:xx:xx:xx:xx:xx
Notice: Signed certificate request for agent1.ap-southeast-1.compute.internal
Notice: Removing file Puppet::SSL::CertificateRequest agent1.ap-southeast-1.compute.internal at '/etc/puppetlabs/puppet/ssl/ca/requests/agent1.ap-southeast-1.compute.internal.pem'
root@ip-172-31-7-177:/home/ubuntu#

7.To verify, run puppet agent again in agent.

root@agent1:/etc/puppetlabs/puppet# puppet agent -tv
Info: Retrieving plugin
Info: Caching catalog for agent1.ap-southeast-1.compute.internal
Info: Applying configuration version '1510728583'
Info: Creating state file /var/lib/puppet/state/state.yaml
Notice: Finished catalog run in 0.01 seconds
root@agent1:/etc/puppetlabs/puppet#