Otdfbt

Why is B♯ higher than C♭ in 31-ET?

Reconstruct a matrix from its traces

In a vacuum triode, what prevents the grid from acting as another anode?

Manager is threatning to grade me poorly if I don't complete the project

Pawn Promotion Double Checks

Returning the outputs of a nested structure

Why is `abs()` implemented differently?

Identifying my late father's D&D stuff found in the attic

Upside-Down Pyramid Addition...REVERSED!

Point of the the Dothraki's attack in GoT S8E3?

My ID is expired, can I fly to the Bahamas with my passport?

Does this article imply that Turing-Computability is not the same as "effectively computable"?

What is the most remote airport from the center of the city it supposedly serves?

If 1. e4 c6 is considered as a sound defense for black, why is 1. c3 so rare?

Short story with physics professor who "brings back the dead" (Asimov or Bradbury?)

How do I tell my manager that his code review comment is wrong?

Was there ever a Kickstart that took advantage of 68020+ instructions that would work on an A2000?

How to give very negative feedback gracefully?

Should I replace my bicycle tires if they have not been inflated in multiple years

60s (or earlier) SF short story with FTL Travel using electron psychology aka addiclenendar technology

Junior developer struggles: how to communicate with management?

Is it cheaper to drop cargo than to land it?

Would "lab meat" be able to feed a much larger global population

In a Latex Table, how can I automatically resize cell heights to account for superscripts?

Puppet unable to send facts to Foreman - “tlsv1 alert unknown ca”

Puppetmaster don't notice changes to site.ppAdd requires to default resources in Puppetpuppet not signing cert or getting new requestsSyntax error at ''; expected '' when using nagios in puppetOwn puppet functionRunning commands in bash for puppetmasterWhat causes the error “Could not retrieve catalog from remote server: execution expired” in PuppetLVM module from puppet forge randomly breaks applying manifestPuppet noob, stuck on the same error for hourspuppet could not find class roles::webserver

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

2

1

I recently updated Katello to 2.2 and Foreman now to 1.8.1, and it appears somewhere in the upgrade that Puppet now cannot contact Foreman:

> [root@virt5 ~]# puppet agent --test info: 
> Retrieving plugin <snipped>
> err: Could not retrieve catalog from remote server: Error 400 on
> SERVER: Failed when searching for node virt5: Failed to find virt5.
> via exec: Execution of '/etc/puppet/node.rb virt5' returned 1:
> warning: Not using cache on failed catalog err: Could not retrieve
> catalog; skipping run

When running the same command on my puppetmaster I see:

[root@foreman certs]# /etc/puppet/node.rb virt5

Could not send facts to Foreman: SSL_connect returned=1 errno=0 state=SSLv3 read server session ticket A: tlsv1 alert unknown ca

I attempted to copy the /etc/pki/katello/certs/katello-default-ca.crt certificate being used by httpd to /etc/pki/ca-trust/source/anchors/ and then run update-ca-trust extract, but that does not appear to have made a difference.

I'm sure I'm missing something silly, I just am unsure as to what that would be.

ssl puppet foreman

share|improve this question

asked May 21 '15 at 17:55

srepetsksrepetsk

112

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  I'm voting to close this question as off-topic because this question is stale, never had a good answer and is unlikely to be revived by the community.
  
  – Stefan Lasiewski
  Nov 21 '18 at 18:24
  

  
  
  
  

add a comment | 

2

1

I recently updated Katello to 2.2 and Foreman now to 1.8.1, and it appears somewhere in the upgrade that Puppet now cannot contact Foreman:

> [root@virt5 ~]# puppet agent --test info: 
> Retrieving plugin <snipped>
> err: Could not retrieve catalog from remote server: Error 400 on
> SERVER: Failed when searching for node virt5: Failed to find virt5.
> via exec: Execution of '/etc/puppet/node.rb virt5' returned 1:
> warning: Not using cache on failed catalog err: Could not retrieve
> catalog; skipping run

When running the same command on my puppetmaster I see:

[root@foreman certs]# /etc/puppet/node.rb virt5

Could not send facts to Foreman: SSL_connect returned=1 errno=0 state=SSLv3 read server session ticket A: tlsv1 alert unknown ca

I attempted to copy the /etc/pki/katello/certs/katello-default-ca.crt certificate being used by httpd to /etc/pki/ca-trust/source/anchors/ and then run update-ca-trust extract, but that does not appear to have made a difference.

I'm sure I'm missing something silly, I just am unsure as to what that would be.

ssl puppet foreman

share|improve this question

asked May 21 '15 at 17:55

srepetsksrepetsk

112

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  I'm voting to close this question as off-topic because this question is stale, never had a good answer and is unlikely to be revived by the community.
  
  – Stefan Lasiewski
  Nov 21 '18 at 18:24
  

  
  
  
  

add a comment | 

I recently updated Katello to 2.2 and Foreman now to 1.8.1, and it appears somewhere in the upgrade that Puppet now cannot contact Foreman:

> [root@virt5 ~]# puppet agent --test info: 
> Retrieving plugin <snipped>
> err: Could not retrieve catalog from remote server: Error 400 on
> SERVER: Failed when searching for node virt5: Failed to find virt5.
> via exec: Execution of '/etc/puppet/node.rb virt5' returned 1:
> warning: Not using cache on failed catalog err: Could not retrieve
> catalog; skipping run

When running the same command on my puppetmaster I see:

[root@foreman certs]# /etc/puppet/node.rb virt5

Could not send facts to Foreman: SSL_connect returned=1 errno=0 state=SSLv3 read server session ticket A: tlsv1 alert unknown ca

I attempted to copy the /etc/pki/katello/certs/katello-default-ca.crt certificate being used by httpd to /etc/pki/ca-trust/source/anchors/ and then run update-ca-trust extract, but that does not appear to have made a difference.

I'm sure I'm missing something silly, I just am unsure as to what that would be.

ssl puppet foreman

share|improve this question

asked May 21 '15 at 17:55

srepetsksrepetsk

112

> [root@virt5 ~]# puppet agent --test info: 
> Retrieving plugin <snipped>
> err: Could not retrieve catalog from remote server: Error 400 on
> SERVER: Failed when searching for node virt5: Failed to find virt5.
> via exec: Execution of '/etc/puppet/node.rb virt5' returned 1:
> warning: Not using cache on failed catalog err: Could not retrieve
> catalog; skipping run

share|improve this question

asked May 21 '15 at 17:55

srepetsksrepetsk

112

share|improve this question

asked May 21 '15 at 17:55

srepetsksrepetsk

112

asked May 21 '15 at 17:55

srepetsksrepetsk

112

asked May 21 '15 at 17:55

srepetsksrepetsk

112

1 Answer
1

active

oldest

votes

0

One mistake I'm seeing here (that should be clearer in the documentation) is that you believe that Katello uses the Puppet certificates like Foreman, but it doesn't.

On the Foreman/Katello host run:

capsule-certs-generate --capsule-fqdn "mycapsule.example.com" 
 --certs-tar "~/mycapsule.example.com-certs.tar"

Where mycapsule.example.com is your other Puppet master.

Unpack that tarball and copy over the "puppet-client" certificate RPM to
your Puppet master, and install it

Copy some files around:

cp /etc/pki/katello-certs-tools/certs/*-puppet-client.crt /etc/puppet/foreman.crt
cp /etc/pki/katello-certs-tools/private/*-puppet-client.key /etc/puppet/foreman.key
cd /etc/puppet
wget https://katello.mydomain.net/pub/katello-default-ca.crt
chown puppet /etc/puppet/foreman.crt,key /etc/puppet/katello*

Configure your /etc/puppet/foreman.yaml like this:

:url: "https://katello.mydomain.net"
:ssl_ca: "/etc/puppet/katello-default-ca.crt"
:ssl_cert: "/etc/puppet/foreman.crt"
:ssl_key: "/etc/puppet/foreman.key"

That should hopefully do it.

share|improve this answer

answered May 22 '15 at 6:49

eLobatoeLobato

26114

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Hi! I followed what you said to do, but the same error occurs. I restarted puppet on the server just to be sure, but that didn't make a change. Both the /etc/puppet/foreman.crt,key files match those from /etc/pki/katello-certs-tools/ (via diff), and the /etc/puppet/foreman.yaml file correctly references those in the Puppet directory along with permissions having been set. Is the /etc/pki/ca-trust folder touched the software at all? I copied both the Katello ca.crt and Puppet's .crt to /etc/pki/ca-trust/source/anchors and ran update-ca-trust, just in case too.
  
  – srepetsk
  May 22 '15 at 18:35
  
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f693668%2fpuppet-unable-to-send-facts-to-foreman-tlsv1-alert-unknown-ca%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

0

One mistake I'm seeing here (that should be clearer in the documentation) is that you believe that Katello uses the Puppet certificates like Foreman, but it doesn't.

On the Foreman/Katello host run:

capsule-certs-generate --capsule-fqdn "mycapsule.example.com" 
 --certs-tar "~/mycapsule.example.com-certs.tar"

Where mycapsule.example.com is your other Puppet master.

Unpack that tarball and copy over the "puppet-client" certificate RPM to
your Puppet master, and install it

Copy some files around:

cp /etc/pki/katello-certs-tools/certs/*-puppet-client.crt /etc/puppet/foreman.crt
cp /etc/pki/katello-certs-tools/private/*-puppet-client.key /etc/puppet/foreman.key
cd /etc/puppet
wget https://katello.mydomain.net/pub/katello-default-ca.crt
chown puppet /etc/puppet/foreman.crt,key /etc/puppet/katello*

Configure your /etc/puppet/foreman.yaml like this:

:url: "https://katello.mydomain.net"
:ssl_ca: "/etc/puppet/katello-default-ca.crt"
:ssl_cert: "/etc/puppet/foreman.crt"
:ssl_key: "/etc/puppet/foreman.key"

That should hopefully do it.

share|improve this answer

answered May 22 '15 at 6:49

eLobatoeLobato

26114

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Hi! I followed what you said to do, but the same error occurs. I restarted puppet on the server just to be sure, but that didn't make a change. Both the /etc/puppet/foreman.crt,key files match those from /etc/pki/katello-certs-tools/ (via diff), and the /etc/puppet/foreman.yaml file correctly references those in the Puppet directory along with permissions having been set. Is the /etc/pki/ca-trust folder touched the software at all? I copied both the Katello ca.crt and Puppet's .crt to /etc/pki/ca-trust/source/anchors and ran update-ca-trust, just in case too.
  
  – srepetsk
  May 22 '15 at 18:35
  
  

  
  
  
  

add a comment | 

0

One mistake I'm seeing here (that should be clearer in the documentation) is that you believe that Katello uses the Puppet certificates like Foreman, but it doesn't.

On the Foreman/Katello host run:

capsule-certs-generate --capsule-fqdn "mycapsule.example.com" 
 --certs-tar "~/mycapsule.example.com-certs.tar"

Where mycapsule.example.com is your other Puppet master.

Unpack that tarball and copy over the "puppet-client" certificate RPM to
your Puppet master, and install it

Copy some files around:

cp /etc/pki/katello-certs-tools/certs/*-puppet-client.crt /etc/puppet/foreman.crt
cp /etc/pki/katello-certs-tools/private/*-puppet-client.key /etc/puppet/foreman.key
cd /etc/puppet
wget https://katello.mydomain.net/pub/katello-default-ca.crt
chown puppet /etc/puppet/foreman.crt,key /etc/puppet/katello*

Configure your /etc/puppet/foreman.yaml like this:

:url: "https://katello.mydomain.net"
:ssl_ca: "/etc/puppet/katello-default-ca.crt"
:ssl_cert: "/etc/puppet/foreman.crt"
:ssl_key: "/etc/puppet/foreman.key"

That should hopefully do it.

share|improve this answer

answered May 22 '15 at 6:49

eLobatoeLobato

26114

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Hi! I followed what you said to do, but the same error occurs. I restarted puppet on the server just to be sure, but that didn't make a change. Both the /etc/puppet/foreman.crt,key files match those from /etc/pki/katello-certs-tools/ (via diff), and the /etc/puppet/foreman.yaml file correctly references those in the Puppet directory along with permissions having been set. Is the /etc/pki/ca-trust folder touched the software at all? I copied both the Katello ca.crt and Puppet's .crt to /etc/pki/ca-trust/source/anchors and ran update-ca-trust, just in case too.
  
  – srepetsk
  May 22 '15 at 18:35
  
  

  
  
  
  

add a comment | 

One mistake I'm seeing here (that should be clearer in the documentation) is that you believe that Katello uses the Puppet certificates like Foreman, but it doesn't.

On the Foreman/Katello host run:

capsule-certs-generate --capsule-fqdn "mycapsule.example.com" 
 --certs-tar "~/mycapsule.example.com-certs.tar"

Where mycapsule.example.com is your other Puppet master.

Unpack that tarball and copy over the "puppet-client" certificate RPM to
your Puppet master, and install it

Copy some files around:

cp /etc/pki/katello-certs-tools/certs/*-puppet-client.crt /etc/puppet/foreman.crt
cp /etc/pki/katello-certs-tools/private/*-puppet-client.key /etc/puppet/foreman.key
cd /etc/puppet
wget https://katello.mydomain.net/pub/katello-default-ca.crt
chown puppet /etc/puppet/foreman.crt,key /etc/puppet/katello*

Configure your /etc/puppet/foreman.yaml like this:

:url: "https://katello.mydomain.net"
:ssl_ca: "/etc/puppet/katello-default-ca.crt"
:ssl_cert: "/etc/puppet/foreman.crt"
:ssl_key: "/etc/puppet/foreman.key"

That should hopefully do it.

share|improve this answer

answered May 22 '15 at 6:49

eLobatoeLobato

26114

capsule-certs-generate --capsule-fqdn "mycapsule.example.com" 
 --certs-tar "~/mycapsule.example.com-certs.tar"

cp /etc/pki/katello-certs-tools/certs/*-puppet-client.crt /etc/puppet/foreman.crt
cp /etc/pki/katello-certs-tools/private/*-puppet-client.key /etc/puppet/foreman.key
cd /etc/puppet
wget https://katello.mydomain.net/pub/katello-default-ca.crt
chown puppet /etc/puppet/foreman.crt,key /etc/puppet/katello*

:url: "https://katello.mydomain.net"
:ssl_ca: "/etc/puppet/katello-default-ca.crt"
:ssl_cert: "/etc/puppet/foreman.crt"
:ssl_key: "/etc/puppet/foreman.key"

share|improve this answer

answered May 22 '15 at 6:49

eLobatoeLobato

26114

answered May 22 '15 at 6:49

eLobatoeLobato

26114

answered May 22 '15 at 6:49

eLobatoeLobato

26114