Puppet SSL证书协商错误 记录
今天agent在拉取配置清单的时候报错, 错误如下1
2
3
4
5
6
7
8
9
10
11
12
13
14
#puppet agent -t --server server212.localdomain
Info: Creating a new SSL key for server214.localdomain
Info: Caching certificate for server214.localdomain
Error: Could not request certificate: The certificate retrieved from the master does not match the agent's private key.
Certificate fingerprint: B1:A2:9F:C2:F7:31:14:B9:10:44:CF:7F:A4:A3:DF:6F:7D:84:85:51:CE:EB:D0:E0:07:90:D0:1A:52:57:4A:05
To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certficate.
On the master:
puppet cert clean server214.localdomain
On the agent:
1a. On most platforms: find /var/lib/puppet/ssl -name server214.localdomain.pem -delete
1b. On Windows: del "/var/lib/puppet/ssl/server214.localdomain.pem" /f
2. puppet agent -t
Exiting; failed to retrieve certificate and waitforcert is disabled
根据提示在master端清除该 agent的证书信息
然后在agent端 查找自己颁发的证书,并删除。
再试试:
1
2
3
4
5
6
7
8
9
#find /var/lib/puppet/ssl -name server214.localdomain.pem -delete
#puppet agent -t --server server212.localdomain
Info: Creating a new SSL key for server214.localdomain
Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for server214.localdomain
Info: Certificate Request fingerprint (SHA256): 1B:B5:6F:F2:C3:D2:BF:22:EA:73:A7:54:3F:D6:41:25:07:B0:36:75:72:11:AC:41:91:A0:C3:19:D9:7C:7B:77
Info: Caching certificate for server214.localdomain
Error: Could not request certificate: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed:
Exiting; failed to retrieve certificate and waitforcert is disabled
结果 还在报错,Error: Could not request certificate: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed:
查了一下,问题应该是出在agent端,于是在agent端删除整个ssl目录
1
# rm -rf /var/lib/puppet/ssl/
然后,再去master端确认下 无问题agent端的证书信息
1
# puppet cert clean server214.localdomain
然后再重新向 master申请证书签发
1
2
3
4
5
6
7
8
#puppet agent -t --server server212.localdomain
Info: Creating a new SSL key for server214.localdomain
Info: Caching certificate for ca
Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for server214.localdomain
Info: Certificate Request fingerprint (SHA256): EC:E9:96:05:3F:17:71:69:4A:13:46:4B:71:BD:4D:FD:90:9C:BF:20:0B:E4:0E:95:06:C8:BF:7A:59:DC:77:F4
Info: Caching certificate for ca
Exiting; no certificate found and waitforcert is disabled
到master端 签证书,然后在agent执行正常的配置清单获取
1
2
3
4
5
6
7
8
#puppet agent -t --server server212.localdomain
Info: Caching certificate for server214.localdomain
Info: Caching certificate_revocation_list for ca
Info: Caching certificate for server214.localdomain
Info: Caching catalog for server214.localdomain
Info: Applying configuration version '1453901147'
Notice: /Stage/Initialization::Kernel_sysctl_config/File/content:
--- /etc/sysctl.conf 2014-10-16 22:53:31.000000000 +0800
正常了。
我这台agent端做过实验,里面已经整的乱七八糟了,索性就把所有ssl/目录下的文件删除就ok。
记录下。
又遇到错误
1
2
3
4
5
6
7
8
9
10
11
# puppet agent --test --server puppet_master
Info: Caching catalog for server178
Info: Applying configuration version '1453903372'
Error: /Stage/Initialization::Kernel_sysctl_config/File: Could not evaluate: Could not retrieve file metadata for puppet:///file_initialization/kernel_sysctl.conf: Error 400 on SERVER: Not authorized to call find on /file_metadata/file_initialization/kernel_sysctl.conf with {:links=>"manage", :source_permissions=>"use"}
Notice: /Stage/Initialization::Kernel_selinux_disabled/Exec/returns: executed successfully
Notice: /Stage/Initialization::Kernel_sysctl_config/Exec: Dependency File has failures: true
Warning: /Stage/Initialization::Kernel_sysctl_config/Exec: Skipping because of failed dependencies
Error: /Stage/Initialization::Kernel_selinux_disabled/File: Could not evaluate: Could not retrieve file metadata for puppet:///file_initialization/selinux_config_file: Error 400 on SERVER: Not authorized to call find on /file_metadata/file_initialization/selinux_config_file with {:links=>"manage", :source_permissions=>"use"}
Notice: /Stage/Initialization::Kernel_selinux_disabled/Notify: Dependency File has failures: true
Warning: /Stage/Initialization::Kernel_selinux_disabled/Notify: Skipping because of failed dependencies
Error: /Stage/Initialization::Kernel_file_descriptor/File: Could not evaluate: Could not retrieve file metadata for puppet:///file_initialization/90-nproc.conf: Error 400 on SERVER: Not authorized to call find on /file_metadata/file_initialization/90-nproc.conf with {:links=>"manage", :source_permissions=>"use"}
重点:Not authorized to call find on /file_metadata/file_initialization/kernel_sysctl.conf
提示为授权的资源获取,那么就和 fileserver.conf 中的配置有关系了。检查里面关于特定目录的allow选项(或者临时的 * 放开全部)。
解决了。
页:
[1]