Plain installation CentOS / SSLCertificateChainFile: file '/var/lib/puppet/ssl/ca/ca_crt.pem' does

Hi!

I've installed a new Foreman.

With :

rpm -ivh http://yum.puppetlabs.com/puppetlabs-release-el-7.noarch.rpm

yum -y install epel-release http://yum.theforeman.org/releases/1.11/el7/x86_64/foreman-release.rpm <http://yum.theforeman.org/releases/1.10/el7/x86_64/foreman-release.rpm>
yum -y install foreman-installer

foreman-installer --enable-foreman-compute-vmware --enable-foreman-plugin-salt --enable-foreman-plugin-setup

During/After installation it reports

Could not start Service[httpd]: Execution of '/bin/systemctl start httpd' returned 1: Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details.
/Stage[main]/Apache::Service/Service[httpd]/ensure: change from stopped to running failed: Could not start Service[httpd]: Execution of '/bin/systemctl start httpd' returned 1: Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details.
/Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[foreman-host.internal.loc]: Could not evaluate: Proxy foreman-host.internal.loc cannot be registered (Could not load data from https://foreman-host.internal.loc
Report processor failed: Could not send report to Foreman at https://foreman-host.internal.loc/api/reports: Connection refused - connect(2)

While checking with "systemctl status httpd.service"

Jun 30 03:28:23 foreman-host.internal.loc systemd[1]: Starting The Apache HTTP Server…

Jun 30 03:28:23 foreman-host.internal.loc httpd[14695]: AH00526: Syntax error on line 36 of /etc/httpd/conf.d/25-puppet.conf:

Jun 30 03:28:23 foreman-host.internal.loc httpd[14695]: SSLCertificateChainFile: file '/var/lib/puppet/ssl/ca/ca_crt.pem' does not exist or is empty

I've no idea how to fix that. I have installed some month ago a Foreman 1.9 with the same options and it works great till now!

Hope someone can help me out…

Thanks,

Tom

This happens when the installer doesn't generate a new Puppet
certificate authority, which it skips if the host already has a Puppet
certificate present (e.g. /var/lib/puppet/ssl/certs/). This happens if
the agent has already run against another master.

If you want a new CA on this server then perhaps delete (move/backup!)
/var/lib/puppet/ssl and either re-run the installer or run "puppet cert
generate $(hostname)", or if you want to use your existing CA then
consider setting --puppet-server-ca=false.

··· On 30/06/16 08:40, Tom K. wrote: > While checking with "systemctl status httpd.service" > > Jun 30 03:28:23 foreman-host.internal.loc systemd[1]: Starting The Apache HTTP Server... > > Jun 30 03:28:23 foreman-host.internal.loc httpd[14695]: AH00526: Syntax error on line 36 of /etc/httpd/conf.d/25-puppet.conf: > > Jun 30 03:28:23 foreman-host.internal.loc httpd[14695]: SSLCertificateChainFile: file '/var/lib/puppet/ssl/ca/ca_crt.pem' does not exist or is empty


Dominic Cleal
dominic@cleal.org

Any chance you would have the machine managed by existing puppet? It's
known it's not working
with the default installer settings
https://github.com/theforeman/foreman-installer/pull/149

If you have a puppet infra already installed, you should probably
follow "Standalone Puppet master"
scenario in Foreman :: Manual

– Ivan

··· On Thu, Jun 30, 2016 at 9:40 AM, Tom K. wrote: > Hi! > > I've installed a new Foreman. > > With : > > rpm -ivh http://yum.puppetlabs.com/puppetlabs-release-el-7.noarch.rpm > > yum -y install epel-release > http://yum.theforeman.org/releases/1.11/el7/x86_64/foreman-release.rpm > yum -y install foreman-installer > > > foreman-installer --enable-foreman-compute-vmware > --enable-foreman-plugin-salt --enable-foreman-plugin-setup > > > > During/After installation it reports > > > Could not start Service[httpd]: Execution of '/bin/systemctl start httpd' > returned 1: Job for httpd.service failed because the control process exited > with error code. See "systemctl status httpd.service" and "journalctl -xe" > for details. > /Stage[main]/Apache::Service/Service[httpd]/ensure: change from stopped to > running failed: Could not start Service[httpd]: Execution of '/bin/systemctl > start httpd' returned 1: Job for httpd.service failed because the control > process exited with error code. See "systemctl status httpd.service" and > "journalctl -xe" for details. > > /Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[foreman-host.internal.loc]: > Could not evaluate: Proxy foreman-host.internal.loc cannot be registered > (Could not load data from https://foreman-host.internal.loc > Report processor failed: Could not send report to Foreman at > https://foreman-host.internal.loc/api/reports: Connection refused - > connect(2) > > > While checking with "systemctl status httpd.service" > > Jun 30 03:28:23 foreman-host.internal.loc systemd[1]: Starting The Apache > HTTP Server... > > Jun 30 03:28:23 foreman-host.internal.loc httpd[14695]: AH00526: Syntax > error on line 36 of /etc/httpd/conf.d/25-puppet.conf: > > Jun 30 03:28:23 foreman-host.internal.loc httpd[14695]: > SSLCertificateChainFile: file '/var/lib/puppet/ssl/ca/ca_crt.pem' does not > exist or is empty > > > > I've no idea how to fix that. I have installed some month ago a Foreman 1.9 > with the same options and it works great till now! > > > > Hope someone can help me out... > > > > Thanks, > > > Tom > > > > > > -- > You received this message because you are subscribed to the Google Groups > "Foreman users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to foreman-users+unsubscribe@googlegroups.com. > To post to this group, send email to foreman-users@googlegroups.com. > Visit this group at https://groups.google.com/group/foreman-users. > For more options, visit https://groups.google.com/d/optout.

Hi Dominic!

So simple… :slight_smile:

But I'm wondering… The machine was a blank new machine.

But I've moved the directory and restarted installation!

It works!!

Thanks a lot for a so quick response!

– Tom

··· Am Donnerstag, 30. Juni 2016 09:45:28 UTC+2 schrieb Dominic Cleal: > > On 30/06/16 08:40, Tom K. wrote: > > While checking with "systemctl status httpd.service" > > > > Jun 30 03:28:23 foreman-host.internal.loc systemd[1]: Starting The > Apache HTTP Server... > > > > Jun 30 03:28:23 foreman-host.internal.loc httpd[14695]: AH00526: Syntax > error on line 36 of /etc/httpd/conf.d/25-puppet.conf: > > > > Jun 30 03:28:23 foreman-host.internal.loc httpd[14695]: > SSLCertificateChainFile: file '/var/lib/puppet/ssl/ca/ca_crt.pem' does not > exist or is empty > > This happens when the installer doesn't generate a new Puppet > certificate authority, which it skips if the host already has a Puppet > certificate present (e.g. /var/lib/puppet/ssl/certs/). This happens if > the agent has already run against another master. > > If you want a new CA on this server then perhaps delete (move/backup!) > /var/lib/puppet/ssl and either re-run the installer or run "puppet cert > generate $(hostname)", or if you want to use your existing CA then > consider setting --puppet-server-ca=false. > > -- > Dominic Cleal > dom...@cleal.org >