Join Log in
Score:0
avatar Server

How to generate certificates for (secondary) compile puppetserver?

ng flag
Tombart

I'm trying to scale puppetserver, in order to have redundancy, using round robin DNS. The secondary puppetserver (version 7.4.0) is configured to use the CA authority from primary puppetserver:

/etc/puppetlabs/puppet/puppet.conf:

[main]
ca_name = Puppet CA: puppet-ca-master.company.com
ca_server = puppet-ca-master.company.com
[agent]
server = puppet-ca-master.company.com
runinterval=1800

On the secondary server I've disabled CA service, as there could be only single certificate authority in /etc/puppetlabs/puppetserver/services.d/ca.cfg:

# To enable the CA service, leave the following line uncommented
# puppetlabs.services.ca.certificate-authority-service/certificate-authority-service
# To disable the CA service, comment out the above line and uncomment the line below
puppetlabs.services.ca.certificate-authority-disabled-service/certificate-authority-disabled-service
puppetlabs.trapperkeeper.services.watcher.filesystem-watch-service/filesystem-watch-service

I've removed certificates from the secondary, in order to fetch certificate signed certificate from the CA master:

rm -rf /etc/puppetlabs/puppet/ssl && mkdir -p /etc/puppetlabs/puppet/ssl/certs
chmod 0700 /etc/puppetlabs/puppet/ssl
chown -R puppet /etc/puppetlabs/puppet/ssl

However the puppetserver service refuses to start because of missing certificate:

2021-09-30T09:06:18.220+02:00 ERROR [async-dispatch-2] [p.t.internal] Error during service start!!!
java.lang.IllegalArgumentException: Unable to open 'ssl-cert' file: /etc/puppetlabs/puppet/ssl/certs/secondary-puppetserver.company.com.pem

When I try to run puppet agent -t on the secondary puppetserver it fails to sign the certificate:

Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (secondary-puppetserver.company.com)

Moreover the private key gets generated, but not a public one:

ll /etc/puppetlabs/puppet/ssl/public_keys/
total 0
190
0 + 0
Score:0
avatar Server
ng flag
Tombart

With round robin DNS CA master config /etc/puppetlabs/puppetserver/conf.d/ca.conf needs to include:

allow-subject-alt-names: true

Restart puppetserver and generate certificates for secondary server on CA master:

puppetserver ca generate --certname puppet-secondary.company.com --subject-alt-names=puppet-secondary.company.com,puppet.company.com

transfer certificates:

rsync -a /etc/puppetlabs/puppet/ssl/private_keys/puppet-secondary.company.com.pem secondary-puppet:/etc/puppetlabs/puppet/ssl/private_keys/
rsync -a /etc/puppetlabs/puppet/ssl/certs/puppet-secondary.company.com.pem secondary-puppet:/etc/puppetlabs/puppet/ssl/certs/
rsync -a /etc/puppetlabs/puppet/ssl/public_keys/puppet-secondary.company.com.pem secondary-puppet:/etc/puppetlabs/puppet/ssl/public_keys/

and CA

rsync -ra /etc/puppetlabs/puppetserver/ca/{ca_crl.pem,ca_crt.pem} secondary-puppet:/etc/puppetlabs/puppetserver/ca/

On secondary make sure that CA service is disabled in /etc/puppetlabs/puppetserver/services.d/ca.cfg.

And make sure that webserver is configured to use correct certs /etc/puppetlabspuppetserver/conf.d/webserver.conf:

webserver: {
    access-log-config: /etc/puppetlabs/puppetserver/request-logging.xml
    client-auth: want
    ssl-host: 0.0.0.0
    ssl-port: 8140
    ssl-cert: /etc/puppetlabs/puppet/ssl/certs/puppet-secondary.company.com.pem
    ssl-key: /etc/puppetlabs/puppet/ssl/private_keys/puppet-secondary.company.com.pem
    ssl-ca-cert: /etc/puppetlabs/puppetserver/ca/ca_crt.pem
    ssl-crl-path: /etc/puppetlabs/puppetserver/ca/ca_crl.pem
}

On CA master DNS alt names could be verified. All puppet servers needs to include the same domain name and other unique name.

puppetserver ca list --all

look for alt names: ["DNS: ... . When certificate is generated using puppet agent, the alt names are not included.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.