On my old puppet setup, i'd run the followingn commands and I'd be able to
regenerate a cert for the client and sign it with the master.
puppet cert clean hostname.local
sudo rm -rf /etc/puppet/ssl
On my Foreman setup, I deleted the host from Foreman and I deleted the
certificate from the smart proxy. I then ran puppet on the client and
signed the new cert with Foreman.
Now I get the following output from the client:
Warning: Unable to fetch my node definition, but the agent run will
continue:
Warning: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate
B: certificate verify failed: [CRL is not yet valid for /CN=Puppet CA:
foreman1.fruit.com]
Info: Retrieving pluginfacts
Error: /File[/var/lib/puppet/facts.d]: Failed to generate additional
resources using 'eval_generate': SSL_connect returned=1 errno=0 state=SSLv3
read server certificate B: Certificate verify failed: [CRL is not yet valid
for /CN=Puppet CA: foreman1.fruit.com]
Error: /File[/var/lib/puppet/facts.d]: Could not evaluate: Could not
retrieve file metadata for puppet://foreman1.fruit.com/pluginfacts:
SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B:
certificate verify failed: [CRL is not yet valid for /CN=Puppet CA:
foreman1.fruit.com]
Info: Retrieving plugin
Error: /File[/var/lib/puppet/lib]: Failed to generate additional resources
using 'eval_generate': SSL_connect returned=1 errno=0 state=SSLv3 read
server certificate B: certificate verify failed: [CRL is not yet valid for
/CN=Puppet CA: foreman1.fruit.com]
Error: /File[/var/lib/puppet/lib]: Could not evaluate: Could not retrieve
file metadata for puppet://foreman1.fruit.com/plugins: SSL_connect
returned=1 errno=0 state=SSLv3 read server certificate B: certificate
verify failed: [CRL is not yet valid for /CN=Puppet CA: foreman1.fruit.com]
Info: Loading facts
Error: Could not retrieve catalog from remote server: SSL_connect
returned=1 errno=0 state=SSLv3 read server certificate B: certificate
verify failed: [CRL is not yet valid for /CN=Puppet CA: foreman1.fruit.com]
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run
Error: Could not send report: SSL_connect returned=1 errno=0 state=SSLv3
read server certificate B: certificate verify failed: [CRL is not yet valid
for /CN=Puppet CA: foreman1.fruit.com]
What am I not cleaning up correctly on the certificate side?