Foreman 3.3 and puppet agent compatibility

Support
1

Hi,

maybe my problem is obvious or present in the doku, but I couldn’t find it. Any help is greatly appreciated!

Problem:

After a fresh install of foreman 3.3 on a debian 10

I want to connect my puppet agents on the clients and this is not working.

On the clients I removed all certificats of my old foreman server. I have a new config entry saying:
cat /etc/puppet/puppet.conf

[agent]
server = foreman3.mydomain.de

On the client side I can do a

puppet agent -t

and it generates new certifcates an sends the request to the foreman server. On the foreman server I’ll do a:

puppetserver ca sign --certname client1.mydomain.de

This works.

But afterwards the next

puppet agent -t

on the client resolves in an error:

puppet agent -t --verbose

---- snip ----

Warning: Unable to fetch my node definition, but the agent run will continue:
Warning: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get issuer certificate): [unable to get issuer certificate for /CN=Puppet CA: foreman3.mydomain.de]
Info: Retrieving pluginfacts
Error: /File[/var/cache/puppet/facts.d]: Failed to generate additional resources using ‘eval_generate’: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get issuer certificate): [unable to get issuer certificate for /CN=Puppet CA: foreman3.mydomain.de]
Error: /File[/var/cache/puppet/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet:///pluginfacts: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get issuer certificate): [unable to get issuer certificate for /CN=Puppet CA: foreman3.mydomain.de]
------- snip -------

Foreman and Proxy versions:

Foreman Server:

  • foreman 3.3
  • puppetserver 6.19.0-1buster

Client versions:
puppet 5.5.22-2
puppet 5.5.10-4

Distribution and version:

Clients debian 9,10 and 11 (8 is running out)

Any hint?

2

No idea? Is it that special?

Does anybody have puppet 5.5 Clients connecting to a version 6 puppetserver?

3

I can’t say I’d ever try 5.5 client with 6 server, but based on what you wrote, you are migrating somehow the clients from old puppet infra to new one? The SSL error indicates, the certificate is not trusted because the CA that signed it is not trusted. If you cleaned up the old certificate from the puppet client, did you also cleaned up the old CA certificate? Perhaps puppet does not install a new Puppet CA cert if it detected the old one is present. But that’s just guess.

4

Thanks Marek, you are the first, that replied! And yes, I have cleared the certificates with:

find /var/lib/puppet/ssl -name ‘*.pem’ -delete

Thats also removing

/var/lib/puppet/ssl/certs/ca.pem

Which is said to be the certificate of the CA.

5

Generally, I would delete the whole ssl directory if you want to reset the ssl certificates on a client. (don’t do that on the puppetserver of course…).

Are you sure your puppet agent uses /var/lib/puppet/ssl? Default should be /etc/puppetlab/puppet/ssl/ in new installations…