Puppet CA is Unable to Connect

Support
1

We have a new Foreman installation, 3.15 with a Puppet Installation and we are stuck on this error trying to connect to the CA,

Failure: ERF50-5345 [Foreman::WrappedException]: Unable to connect ([ProxyAPI::ProxyException]: ERF12-5356 [ProxyAPI::ProxyException]: Unable to get PuppetCA certificates ([RestClient::NotAcceptable]: 406 Not Acceptable) for proxy https://my.server.com:9090/puppet/ca)

Not sure how to fix this issue.

2

have you changed the default port ?

what does /etc/foreman-proxy/settings.d/puppetca_http_api.yml show for your config ?
same with puppet_proxy_puppet_api.yml

3

No. didn’t change the default port. This is the output for puppetca_http_api.yml

URL of the puppet master itself for API requests.

:puppet_url: https://my.server.com:8140

SSL certificates used to access the CA API.

:puppet_ssl_ca: /etc/puppetlabs/puppet/ssl/certs/ca.pem
:puppet_ssl_cert: /etc/puppetlabs/puppet/ssl/certs/my.server.com.pem
:puppet_ssl_key: /etc/puppetlabs/puppet/ssl/private_keys/my.server.com.pem

And the output for puppet_proxy_puppet_api.yml

URL of the puppet master itself for API requests.

:puppet_url: https://my.server.com:8140

SSL certificates used to access the puppet API

:puppet_ssl_ca: /etc/puppetlabs/puppet/ssl/certs/ca.pem
:puppet_ssl_cert: /etc/puppetlabs/puppet/ssl/certs/my.server.com.pem
:puppet_ssl_key: /etc/puppetlabs/puppet/ssl/private_keys/my.server.com.pem

Smart Proxy api timeout when Puppet’s environment classes api is used and classes cache is disabled

:api_timeout: 30

4

I figured this out. The Discovery feature was causing issue with the Puppet CA connection. After removing the Discovery feature the Smart Proxy was able to connect to the Puppet CA.