Puppet SSL證書協商錯誤 記錄

今天agent在拉取配置清單的時候報錯， 錯誤如下

[root@server214 ~]#puppet agent -t --server server212.localdomain
Info: Creating a new SSL key for server214.localdomain
Info: Caching certificate for server214.localdomain
Error: Could not request certificate: The certificate retrieved from the master does not match the agent's private key.
Certificate fingerprint: B1:A2:9F:C2:F7:31:14:B9:10:44:CF:7F:A4:A3:DF:6F:7D:84:85:51:CE:EB:D0:E0:07:90:D0:1A:52:57:4A:05
To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certficate.
On the master:
  puppet cert clean server214.localdomain
On the agent:
  1a. On most platforms: find /var/lib/puppet/ssl -name server214.localdomain.pem -delete
  1b. On Windows: del "/var/lib/puppet/ssl/server214.localdomain.pem" /f
  2. puppet agent -t

Exiting; failed to retrieve certificate and waitforcert is disabled

 

根據提示在master端清除該 agent的證書信息

然後在agent端 查找自己頒發的證書，並刪除。

再試試：

[root@server214 ~]#find /var/lib/puppet/ssl -name server214.localdomain.pem -delete
[root@server214 ~]#puppet agent -t --server server212.localdomain
Info: Creating a new SSL key for server214.localdomain
Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for server214.localdomain
Info: Certificate Request fingerprint (SHA256): 1B:B5:6F:F2:C3:D2:BF:22:EA:73:A7:54:3F:D6:41:25:07:B0:36:75:72:11:AC:41:91:A0:C3:19:D9:7C:7B:77
Info: Caching certificate for server214.localdomain
Error: Could not request certificate: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [self signed certificate in certificate chain for /CN=Puppet CA: server212.localdomain]
Exiting; failed to retrieve certificate and waitforcert is disabled

 

結果 還在報錯，Error: Could not request certificate: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [self signed certificate in certificate chain for /CN=Puppet CA: server212.localdomain]

 

查了一下，問題應該是出在agent端，於是在agent端刪除整個ssl目錄

# rm -rf /var/lib/puppet/ssl/

然後，再去master端確認下 無問題agent端的證書信息

# puppet cert clean server214.localdomain

 

 

然後再重新向 master申請證書籤發

[root@server214 ~]#puppet agent -t --server server212.localdomain
Info: Creating a new SSL key for server214.localdomain
Info: Caching certificate for ca
Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for server214.localdomain
Info: Certificate Request fingerprint (SHA256): EC:E9:96:05:3F:17:71:69:4A:13:46:4B:71:BD:4D:FD:90:9C:BF:20:0B:E4:0E:95:06:C8:BF:7A:59:DC:77:F4
Info: Caching certificate for ca
Exiting; no certificate found and waitforcert is disabled

 

到master端 簽證書，然後在agent執行正常的配置清單獲取

簽發證書

puppet cert --sign node1.zhang.com

 

如果一次性簽發所有的證書，採用如下命令：

puppet cert --sign –all

 

也可以設置自動簽發證書。

[root@server214 ~]#puppet agent -t --server server212.localdomain
Info: Caching certificate for server214.localdomain
Info: Caching certificate_revocation_list for ca
Info: Caching certificate for server214.localdomain
Info: Caching catalog for server214.localdomain
Info: Applying configuration version '1453901147'
Notice: /Stage[first]/Initialization::Kernel_sysctl_config/File[transfer_sysctl.conf]/content:
--- /etc/sysctl.conf    2014-10-16 22:53:31.000000000 +0800

正常了。  

我這臺agent端做過實驗，裏面已經整的亂七八糟了，索性就把所有ssl/目錄下的文件刪除就ok。

 

記錄下。 

---

又遇到錯誤

[root@server178 ~]# puppet agent --test --server puppet_master
Info: Caching catalog for server178
Info: Applying configuration version '1453903372'
Error: /Stage[first]/Initialization::Kernel_sysctl_config/File[transfer_sysctl.conf]: Could not evaluate: Could not retrieve file metadata for puppet:///file_initialization/kernel_sysctl.conf: Error 400 on SERVER: Not authorized to call find on /file_metadata/file_initialization/kernel_sysctl.conf with {:links=>"manage", :source_permissions=>"use"}
Notice: /Stage[first]/Initialization::Kernel_selinux_disabled/Exec[permissive_selinux]/returns: executed successfully
Notice: /Stage[first]/Initialization::Kernel_sysctl_config/Exec[accept_sysctl.conf]: Dependency File[transfer_sysctl.conf] has failures: true
Warning: /Stage[first]/Initialization::Kernel_sysctl_config/Exec[accept_sysctl.conf]: Skipping because of failed dependencies
Error: /Stage[first]/Initialization::Kernel_selinux_disabled/File[transfer_selinux_config]: Could not evaluate: Could not retrieve file metadata for puppet:///file_initialization/selinux_config_file: Error 400 on SERVER: Not authorized to call find on /file_metadata/file_initialization/selinux_config_file with {:links=>"manage", :source_permissions=>"use"}
Notice: /Stage[first]/Initialization::Kernel_selinux_disabled/Notify[selinux_config Done]: Dependency File[transfer_selinux_config] has failures: true
Warning: /Stage[first]/Initialization::Kernel_selinux_disabled/Notify[selinux_config Done]: Skipping because of failed dependencies
Error: /Stage[first]/Initialization::Kernel_file_descriptor/File[90-nproc.conf]: Could not evaluate: Could not retrieve file metadata for puppet:///file_initialization/90-nproc.conf: Error 400 on SERVER: Not authorized to call find on /file_metadata/file_initialization/90-nproc.conf with {:links=>"manage", :source_permissions=>"use"}

 重點：Not authorized to call find on /file_metadata/file_initialization/kernel_sysctl.conf

提示爲授權的資源獲取，那麼就和 fileserver.conf 中的配置有關係了。檢查裏面關於特定目錄的allow選項（或者臨時的 * 放開全部）。

解決了。