Puppet SSL证书协商错误 记录

21ewd

今天agent在拉取配置清单的时候报错， 错误如下

1 2 3 4 5 6 7 8 9 10 11 12 13 14

[iyunv@server214 ~]#puppet agent -t --server server212.localdomain Info: Creating a new SSL key for server214.localdomain Info: Caching certificate for server214.localdomain Error: Could not request certificate: The certificate retrieved from the master does not match the agent's private key. Certificate fingerprint: B1:A2:9F:C2:F7:31:14:B9:10:44:CF:7F:A4:A3:DF:6F:7D:84:85:51:CE:EB:D0:E0:07:90:D0:1A:52:57:4A:05 To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certficate. On the master:   puppet cert clean server214.localdomain On the agent:   1a. On most platforms: find /var/lib/puppet/ssl -name server214.localdomain.pem -delete   1b. On Windows: del "/var/lib/puppet/ssl/server214.localdomain.pem" /f   2. puppet agent -t Exiting; failed to retrieve certificate and waitforcert is disabled

根据提示在master端清除该 agent的证书信息
然后在agent端 查找自己颁发的证书，并删除。

再试试：

1 2 3 4 5 6 7 8 9

[iyunv@server214 ~]#find /var/lib/puppet/ssl -name server214.localdomain.pem -delete [iyunv@server214 ~]#puppet agent -t --server server212.localdomain Info: Creating a new SSL key for server214.localdomain Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml Info: Creating a new SSL certificate request for server214.localdomain Info: Certificate Request fingerprint (SHA256): 1B:B5:6F:F2:C3:D2:BF:22:EA:73:A7:54:3F:D6:41:25:07:B0:36:75:72:11:AC:41:91:A0:C3:19:D9:7C:7B:77 Info: Caching certificate for server214.localdomain Error: Could not request certificate: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [self signed certificate in certificate chain for /CN=Puppet CA: server212.localdomain] Exiting; failed to retrieve certificate and waitforcert is disabled

结果 还在报错，Error: Could not request certificate: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [self signed certificate in certificate chain for /CN=Puppet CA: server212.localdomain]

查了一下，问题应该是出在agent端，于是在agent端删除整个ssl目录

1	# rm -rf /var/lib/puppet/ssl/

然后，再去master端确认下 无问题agent端的证书信息

1	# puppet cert clean server214.localdomain

然后再重新向 master申请证书签发

1 2 3 4 5 6 7 8

[iyunv@server214 ~]#puppet agent -t --server server212.localdomain Info: Creating a new SSL key for server214.localdomain Info: Caching certificate for ca Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml Info: Creating a new SSL certificate request for server214.localdomain Info: Certificate Request fingerprint (SHA256): EC:E9:96:05:3F:17:71:69:4A:13:46:4B:71:BD:4D:FD:90:9C:BF:20:0B:E4:0E:95:06:C8:BF:7A:59:DC:77:F4 Info: Caching certificate for ca Exiting; no certificate found and waitforcert is disabled

到master端 签证书，然后在agent执行正常的配置清单获取

1 2 3 4 5 6 7 8

[iyunv@server214 ~]#puppet agent -t --server server212.localdomain Info: Caching certificate for server214.localdomain Info: Caching certificate_revocation_list for ca Info: Caching certificate for server214.localdomain Info: Caching catalog for server214.localdomain Info: Applying configuration version '1453901147' Notice: /Stage[first]/Initialization::Kernel_sysctl_config/File[transfer_sysctl.conf]/content: --- /etc/sysctl.conf    2014-10-16 22:53:31.000000000 +0800

正常了。  
我这台agent端做过实验，里面已经整的乱七八糟了，索性就把所有ssl/目录下的文件删除就ok。

记录下。

---

又遇到错误

1 2 3 4 5 6 7 8 9 10 11

[iyunv@server178 ~]# puppet agent --test --server puppet_master Info: Caching catalog for server178 Info: Applying configuration version '1453903372' Error: /Stage[first]/Initialization::Kernel_sysctl_config/File[transfer_sysctl.conf]: Could not evaluate: Could not retrieve file metadata for puppet:///file_initialization/kernel_sysctl.conf: Error 400 on SERVER: Not authorized to call find on /file_metadata/file_initialization/kernel_sysctl.conf with {:links=>"manage", :source_permissions=>"use"} Notice: /Stage[first]/Initialization::Kernel_selinux_disabled/Exec[permissive_selinux]/returns: executed successfully Notice: /Stage[first]/Initialization::Kernel_sysctl_config/Exec[accept_sysctl.conf]: Dependency File[transfer_sysctl.conf] has failures: true Warning: /Stage[first]/Initialization::Kernel_sysctl_config/Exec[accept_sysctl.conf]: Skipping because of failed dependencies Error: /Stage[first]/Initialization::Kernel_selinux_disabled/File[transfer_selinux_config]: Could not evaluate: Could not retrieve file metadata for puppet:///file_initialization/selinux_config_file: Error 400 on SERVER: Not authorized to call find on /file_metadata/file_initialization/selinux_config_file with {:links=>"manage", :source_permissions=>"use"} Notice: /Stage[first]/Initialization::Kernel_selinux_disabled/Notify[selinux_config Done]: Dependency File[transfer_selinux_config] has failures: true Warning: /Stage[first]/Initialization::Kernel_selinux_disabled/Notify[selinux_config Done]: Skipping because of failed dependencies Error: /Stage[first]/Initialization::Kernel_file_descriptor/File[90-nproc.conf]: Could not evaluate: Could not retrieve file metadata for puppet:///file_initialization/90-nproc.conf: Error 400 on SERVER: Not authorized to call find on /file_metadata/file_initialization/90-nproc.conf with {:links=>"manage", :source_permissions=>"use"}

重点：Not authorized to call find on /file_metadata/file_initialization/kernel_sysctl.conf
提示为授权的资源获取，那么就和 fileserver.conf 中的配置有关系了。检查里面关于特定目录的allow选项（或者临时的 * 放开全部）。


解决了。