Puppet unable to send facts to Foreman - “tlsv1 alert unknown ca”Puppetmaster don't notice changes to site.ppAdd requires to default resources in Puppetpuppet not signing cert or getting new requestsSyntax error at ''; expected '' when using nagios in puppetOwn puppet functionRunning commands in bash for puppetmasterWhat causes the error “Could not retrieve catalog from remote server: execution expired” in PuppetLVM module from puppet forge randomly breaks applying manifestPuppet noob, stuck on the same error for hourspuppet could not find class roles::webserver
Why is B♯ higher than C♭ in 31-ET?
Reconstruct a matrix from its traces
In a vacuum triode, what prevents the grid from acting as another anode?
Manager is threatning to grade me poorly if I don't complete the project
Pawn Promotion Double Checks
Returning the outputs of a nested structure
Why is `abs()` implemented differently?
Identifying my late father's D&D stuff found in the attic
Upside-Down Pyramid Addition...REVERSED!
Point of the the Dothraki's attack in GoT S8E3?
My ID is expired, can I fly to the Bahamas with my passport?
Does this article imply that Turing-Computability is not the same as "effectively computable"?
What is the most remote airport from the center of the city it supposedly serves?
If 1. e4 c6 is considered as a sound defense for black, why is 1. c3 so rare?
Short story with physics professor who "brings back the dead" (Asimov or Bradbury?)
How do I tell my manager that his code review comment is wrong?
Was there ever a Kickstart that took advantage of 68020+ instructions that would work on an A2000?
How to give very negative feedback gracefully?
Should I replace my bicycle tires if they have not been inflated in multiple years
60s (or earlier) SF short story with FTL Travel using electron psychology aka addiclenendar technology
Junior developer struggles: how to communicate with management?
Is it cheaper to drop cargo than to land it?
Would "lab meat" be able to feed a much larger global population
In a Latex Table, how can I automatically resize cell heights to account for superscripts?
Puppet unable to send facts to Foreman - “tlsv1 alert unknown ca”
Puppetmaster don't notice changes to site.ppAdd requires to default resources in Puppetpuppet not signing cert or getting new requestsSyntax error at ''; expected '' when using nagios in puppetOwn puppet functionRunning commands in bash for puppetmasterWhat causes the error “Could not retrieve catalog from remote server: execution expired” in PuppetLVM module from puppet forge randomly breaks applying manifestPuppet noob, stuck on the same error for hourspuppet could not find class roles::webserver
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I recently updated Katello to 2.2 and Foreman now to 1.8.1, and it appears somewhere in the upgrade that Puppet now cannot contact Foreman:
> [root@virt5 ~]# puppet agent --test info:
> Retrieving plugin <snipped>
> err: Could not retrieve catalog from remote server: Error 400 on
> SERVER: Failed when searching for node virt5: Failed to find virt5.
> via exec: Execution of '/etc/puppet/node.rb virt5' returned 1:
> warning: Not using cache on failed catalog err: Could not retrieve
> catalog; skipping run
When running the same command on my puppetmaster I see:
[root@foreman certs]# /etc/puppet/node.rb virt5
Could not send facts to Foreman: SSL_connect returned=1 errno=0 state=SSLv3 read server session ticket A: tlsv1 alert unknown ca
I attempted to copy the /etc/pki/katello/certs/katello-default-ca.crt certificate being used by httpd to /etc/pki/ca-trust/source/anchors/ and then run update-ca-trust extract, but that does not appear to have made a difference.
I'm sure I'm missing something silly, I just am unsure as to what that would be.
ssl puppet foreman
asked May 21 '15 at 17:55
srepetsksrepetsk
112
add a comment |
I recently updated Katello to 2.2 and Foreman now to 1.8.1, and it appears somewhere in the upgrade that Puppet now cannot contact Foreman:
> [root@virt5 ~]# puppet agent --test info:
> Retrieving plugin <snipped>
> err: Could not retrieve catalog from remote server: Error 400 on
> SERVER: Failed when searching for node virt5: Failed to find virt5.
> via exec: Execution of '/etc/puppet/node.rb virt5' returned 1:
> warning: Not using cache on failed catalog err: Could not retrieve
> catalog; skipping run
When running the same command on my puppetmaster I see:
[root@foreman certs]# /etc/puppet/node.rb virt5
Could not send facts to Foreman: SSL_connect returned=1 errno=0 state=SSLv3 read server session ticket A: tlsv1 alert unknown ca
I attempted to copy the /etc/pki/katello/certs/katello-default-ca.crt certificate being used by httpd to /etc/pki/ca-trust/source/anchors/ and then run update-ca-trust extract, but that does not appear to have made a difference.
I'm sure I'm missing something silly, I just am unsure as to what that would be.
ssl puppet foreman
asked May 21 '15 at 17:55
srepetsksrepetsk
112
1
I'm voting to close this question as off-topic because this question is stale, never had a good answer and is unlikely to be revived by the community.
– Stefan Lasiewski
Nov 21 '18 at 18:24
add a comment |
I recently updated Katello to 2.2 and Foreman now to 1.8.1, and it appears somewhere in the upgrade that Puppet now cannot contact Foreman:
> [root@virt5 ~]# puppet agent --test info:
> Retrieving plugin <snipped>
> err: Could not retrieve catalog from remote server: Error 400 on
> SERVER: Failed when searching for node virt5: Failed to find virt5.
> via exec: Execution of '/etc/puppet/node.rb virt5' returned 1:
> warning: Not using cache on failed catalog err: Could not retrieve
> catalog; skipping run
When running the same command on my puppetmaster I see:
[root@foreman certs]# /etc/puppet/node.rb virt5
Could not send facts to Foreman: SSL_connect returned=1 errno=0 state=SSLv3 read server session ticket A: tlsv1 alert unknown ca
I attempted to copy the /etc/pki/katello/certs/katello-default-ca.crt certificate being used by httpd to /etc/pki/ca-trust/source/anchors/ and then run update-ca-trust extract, but that does not appear to have made a difference.
I'm sure I'm missing something silly, I just am unsure as to what that would be.
ssl puppet foreman
asked May 21 '15 at 17:55
srepetsksrepetsk
112
I recently updated Katello to 2.2 and Foreman now to 1.8.1, and it appears somewhere in the upgrade that Puppet now cannot contact Foreman:
> [root@virt5 ~]# puppet agent --test info:
> Retrieving plugin <snipped>
> err: Could not retrieve catalog from remote server: Error 400 on
> SERVER: Failed when searching for node virt5: Failed to find virt5.
> via exec: Execution of '/etc/puppet/node.rb virt5' returned 1:
> warning: Not using cache on failed catalog err: Could not retrieve
> catalog; skipping run
When running the same command on my puppetmaster I see:
[root@foreman certs]# /etc/puppet/node.rb virt5
Could not send facts to Foreman: SSL_connect returned=1 errno=0 state=SSLv3 read server session ticket A: tlsv1 alert unknown ca
I attempted to copy the /etc/pki/katello/certs/katello-default-ca.crt certificate being used by httpd to /etc/pki/ca-trust/source/anchors/ and then run update-ca-trust extract, but that does not appear to have made a difference.
I'm sure I'm missing something silly, I just am unsure as to what that would be.
ssl puppet foreman
ssl puppet foreman
asked May 21 '15 at 17:55
srepetsksrepetsk
112
asked May 21 '15 at 17:55
srepetsksrepetsk
112
asked May 21 '15 at 17:55
srepetsksrepetsk
112
asked May 21 '15 at 17:55
srepetsksrepetsk
112
asked May 21 '15 at 17:55
srepetsksrepetsk
112
112
1
I'm voting to close this question as off-topic because this question is stale, never had a good answer and is unlikely to be revived by the community.
– Stefan Lasiewski
Nov 21 '18 at 18:24
add a comment |
1
I'm voting to close this question as off-topic because this question is stale, never had a good answer and is unlikely to be revived by the community.
– Stefan Lasiewski
Nov 21 '18 at 18:24
1
1
I'm voting to close this question as off-topic because this question is stale, never had a good answer and is unlikely to be revived by the community.
– Stefan Lasiewski
Nov 21 '18 at 18:24
I'm voting to close this question as off-topic because this question is stale, never had a good answer and is unlikely to be revived by the community.
– Stefan Lasiewski
Nov 21 '18 at 18:24
add a comment |
1 Answer
1
active
oldest
votes
One mistake I'm seeing here (that should be clearer in the documentation) is that you believe that Katello uses the Puppet certificates like Foreman, but it doesn't.
On the Foreman/Katello host run:
capsule-certs-generate --capsule-fqdn "mycapsule.example.com"
--certs-tar "~/mycapsule.example.com-certs.tar"
Where mycapsule.example.com is your other Puppet master.
Unpack that tarball and copy over the "puppet-client" certificate RPM to
your Puppet master, and install it
Copy some files around:
cp /etc/pki/katello-certs-tools/certs/*-puppet-client.crt /etc/puppet/foreman.crt
cp /etc/pki/katello-certs-tools/private/*-puppet-client.key /etc/puppet/foreman.key
cd /etc/puppet
wget https://katello.mydomain.net/pub/katello-default-ca.crt
chown puppet /etc/puppet/foreman.crt,key /etc/puppet/katello*
Configure your /etc/puppet/foreman.yaml like this:
:url: "https://katello.mydomain.net"
:ssl_ca: "/etc/puppet/katello-default-ca.crt"
:ssl_cert: "/etc/puppet/foreman.crt"
:ssl_key: "/etc/puppet/foreman.key"
That should hopefully do it.
answered May 22 '15 at 6:49
eLobatoeLobato
26114
Hi! I followed what you said to do, but the same error occurs. I restarted puppet on the server just to be sure, but that didn't make a change. Both the /etc/puppet/foreman.crt,key files match those from /etc/pki/katello-certs-tools/ (viadiff), and the /etc/puppet/foreman.yaml file correctly references those in the Puppet directory along with permissions having been set. Is the /etc/pki/ca-trust folder touched the software at all? I copied both the Katello ca.crt and Puppet's .crt to /etc/pki/ca-trust/source/anchors and ran update-ca-trust, just in case too.
– srepetsk
May 22 '15 at 18:35
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f693668%2fpuppet-unable-to-send-facts-to-foreman-tlsv1-alert-unknown-ca%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
One mistake I'm seeing here (that should be clearer in the documentation) is that you believe that Katello uses the Puppet certificates like Foreman, but it doesn't.
On the Foreman/Katello host run:
capsule-certs-generate --capsule-fqdn "mycapsule.example.com"
--certs-tar "~/mycapsule.example.com-certs.tar"
Where mycapsule.example.com is your other Puppet master.
Unpack that tarball and copy over the "puppet-client" certificate RPM to
your Puppet master, and install it
Copy some files around:
cp /etc/pki/katello-certs-tools/certs/*-puppet-client.crt /etc/puppet/foreman.crt
cp /etc/pki/katello-certs-tools/private/*-puppet-client.key /etc/puppet/foreman.key
cd /etc/puppet
wget https://katello.mydomain.net/pub/katello-default-ca.crt
chown puppet /etc/puppet/foreman.crt,key /etc/puppet/katello*
Configure your /etc/puppet/foreman.yaml like this:
:url: "https://katello.mydomain.net"
:ssl_ca: "/etc/puppet/katello-default-ca.crt"
:ssl_cert: "/etc/puppet/foreman.crt"
:ssl_key: "/etc/puppet/foreman.key"
That should hopefully do it.
answered May 22 '15 at 6:49
eLobatoeLobato
26114
Hi! I followed what you said to do, but the same error occurs. I restarted puppet on the server just to be sure, but that didn't make a change. Both the /etc/puppet/foreman.crt,key files match those from /etc/pki/katello-certs-tools/ (viadiff), and the /etc/puppet/foreman.yaml file correctly references those in the Puppet directory along with permissions having been set. Is the /etc/pki/ca-trust folder touched the software at all? I copied both the Katello ca.crt and Puppet's .crt to /etc/pki/ca-trust/source/anchors and ran update-ca-trust, just in case too.
– srepetsk
May 22 '15 at 18:35
add a comment |
One mistake I'm seeing here (that should be clearer in the documentation) is that you believe that Katello uses the Puppet certificates like Foreman, but it doesn't.
On the Foreman/Katello host run:
capsule-certs-generate --capsule-fqdn "mycapsule.example.com"
--certs-tar "~/mycapsule.example.com-certs.tar"
Where mycapsule.example.com is your other Puppet master.
Unpack that tarball and copy over the "puppet-client" certificate RPM to
your Puppet master, and install it
Copy some files around:
cp /etc/pki/katello-certs-tools/certs/*-puppet-client.crt /etc/puppet/foreman.crt
cp /etc/pki/katello-certs-tools/private/*-puppet-client.key /etc/puppet/foreman.key
cd /etc/puppet
wget https://katello.mydomain.net/pub/katello-default-ca.crt
chown puppet /etc/puppet/foreman.crt,key /etc/puppet/katello*
Configure your /etc/puppet/foreman.yaml like this:
:url: "https://katello.mydomain.net"
:ssl_ca: "/etc/puppet/katello-default-ca.crt"
:ssl_cert: "/etc/puppet/foreman.crt"
:ssl_key: "/etc/puppet/foreman.key"
That should hopefully do it.
answered May 22 '15 at 6:49
eLobatoeLobato
26114
Hi! I followed what you said to do, but the same error occurs. I restarted puppet on the server just to be sure, but that didn't make a change. Both the /etc/puppet/foreman.crt,key files match those from /etc/pki/katello-certs-tools/ (viadiff), and the /etc/puppet/foreman.yaml file correctly references those in the Puppet directory along with permissions having been set. Is the /etc/pki/ca-trust folder touched the software at all? I copied both the Katello ca.crt and Puppet's .crt to /etc/pki/ca-trust/source/anchors and ran update-ca-trust, just in case too.
– srepetsk
May 22 '15 at 18:35
add a comment |
One mistake I'm seeing here (that should be clearer in the documentation) is that you believe that Katello uses the Puppet certificates like Foreman, but it doesn't.
On the Foreman/Katello host run:
capsule-certs-generate --capsule-fqdn "mycapsule.example.com"
--certs-tar "~/mycapsule.example.com-certs.tar"
Where mycapsule.example.com is your other Puppet master.
Unpack that tarball and copy over the "puppet-client" certificate RPM to
your Puppet master, and install it
Copy some files around:
cp /etc/pki/katello-certs-tools/certs/*-puppet-client.crt /etc/puppet/foreman.crt
cp /etc/pki/katello-certs-tools/private/*-puppet-client.key /etc/puppet/foreman.key
cd /etc/puppet
wget https://katello.mydomain.net/pub/katello-default-ca.crt
chown puppet /etc/puppet/foreman.crt,key /etc/puppet/katello*
Configure your /etc/puppet/foreman.yaml like this:
:url: "https://katello.mydomain.net"
:ssl_ca: "/etc/puppet/katello-default-ca.crt"
:ssl_cert: "/etc/puppet/foreman.crt"
:ssl_key: "/etc/puppet/foreman.key"
That should hopefully do it.
answered May 22 '15 at 6:49
eLobatoeLobato
26114
One mistake I'm seeing here (that should be clearer in the documentation) is that you believe that Katello uses the Puppet certificates like Foreman, but it doesn't.
On the Foreman/Katello host run:
capsule-certs-generate --capsule-fqdn "mycapsule.example.com"
--certs-tar "~/mycapsule.example.com-certs.tar"
Where mycapsule.example.com is your other Puppet master.
Unpack that tarball and copy over the "puppet-client" certificate RPM to
your Puppet master, and install it
Copy some files around:
cp /etc/pki/katello-certs-tools/certs/*-puppet-client.crt /etc/puppet/foreman.crt
cp /etc/pki/katello-certs-tools/private/*-puppet-client.key /etc/puppet/foreman.key
cd /etc/puppet
wget https://katello.mydomain.net/pub/katello-default-ca.crt
chown puppet /etc/puppet/foreman.crt,key /etc/puppet/katello*
Configure your /etc/puppet/foreman.yaml like this:
:url: "https://katello.mydomain.net"
:ssl_ca: "/etc/puppet/katello-default-ca.crt"
:ssl_cert: "/etc/puppet/foreman.crt"
:ssl_key: "/etc/puppet/foreman.key"
That should hopefully do it.
answered May 22 '15 at 6:49
eLobatoeLobato
26114
answered May 22 '15 at 6:49
eLobatoeLobato
26114
answered May 22 '15 at 6:49
eLobatoeLobato
26114
answered May 22 '15 at 6:49
eLobatoeLobato
26114
26114
Hi! I followed what you said to do, but the same error occurs. I restarted puppet on the server just to be sure, but that didn't make a change. Both the /etc/puppet/foreman.crt,key files match those from /etc/pki/katello-certs-tools/ (viadiff), and the /etc/puppet/foreman.yaml file correctly references those in the Puppet directory along with permissions having been set. Is the /etc/pki/ca-trust folder touched the software at all? I copied both the Katello ca.crt and Puppet's .crt to /etc/pki/ca-trust/source/anchors and ran update-ca-trust, just in case too.
– srepetsk
May 22 '15 at 18:35
add a comment |
Hi! I followed what you said to do, but the same error occurs. I restarted puppet on the server just to be sure, but that didn't make a change. Both the /etc/puppet/foreman.crt,key files match those from /etc/pki/katello-certs-tools/ (viadiff), and the /etc/puppet/foreman.yaml file correctly references those in the Puppet directory along with permissions having been set. Is the /etc/pki/ca-trust folder touched the software at all? I copied both the Katello ca.crt and Puppet's .crt to /etc/pki/ca-trust/source/anchors and ran update-ca-trust, just in case too.
– srepetsk
May 22 '15 at 18:35
Hi! I followed what you said to do, but the same error occurs. I restarted puppet on the server just to be sure, but that didn't make a change. Both the /etc/puppet/foreman.crt,key files match those from /etc/pki/katello-certs-tools/ (via
diff), and the /etc/puppet/foreman.yaml file correctly references those in the Puppet directory along with permissions having been set. Is the /etc/pki/ca-trust folder touched the software at all? I copied both the Katello ca.crt and Puppet's .crt to /etc/pki/ca-trust/source/anchors and ran update-ca-trust, just in case too.– srepetsk
May 22 '15 at 18:35
Hi! I followed what you said to do, but the same error occurs. I restarted puppet on the server just to be sure, but that didn't make a change. Both the /etc/puppet/foreman.crt,key files match those from /etc/pki/katello-certs-tools/ (via
diff), and the /etc/puppet/foreman.yaml file correctly references those in the Puppet directory along with permissions having been set. Is the /etc/pki/ca-trust folder touched the software at all? I copied both the Katello ca.crt and Puppet's .crt to /etc/pki/ca-trust/source/anchors and ran update-ca-trust, just in case too.– srepetsk
May 22 '15 at 18:35
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f693668%2fpuppet-unable-to-send-facts-to-foreman-tlsv1-alert-unknown-ca%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
I'm voting to close this question as off-topic because this question is stale, never had a good answer and is unlikely to be revived by the community.
– Stefan Lasiewski
Nov 21 '18 at 18:24