starting the service and then running the command nets me

Fatal error when running action 'generate'
  Error: Failed connecting to <https://puppet:8140/puppet-ca/v1/certificate_request/>
  Root cause: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate)

Which goal from that table do you need?

Which goal from that table do you need?

all of this works as root, but not as user

Yeah, that's expected.

Is there reason you need to run as non-root?

i thought it was best practice to do this non root?

i've set this all up as root and it's incredibly easy

but now i'm working on non root

should i just.. stay as root? (I mean.. i will... don't get me wrong, i would love to)

Puppetserver generally runs as a non-root user, but that's not the same thing as generating a new cert with alt names. At the very least, you definitely can't do this as an arbitrary non-root user and would need to run this as the same user the puppetserver service runs as. But it's simpler to just use

sudo

any time you need to run a

puppetserer ca

command.

Also, don't forget that

--ca-client

flag in step 4.

shit

that last flag was literally it

i can't believe i didn't scroll over and see that

thank you @natemccurdy, I really appreciate you

dammit

whole day today

lol

Yup. I'd go that route as well. But not everyone has a well manicured environment where everything on every node is Puppet managed, unfortunately.

This message was deleted.

I'm having trouble formatting my company's private key when using eyaml. Since the public key doesn't need to be encrypted, the yaml information is parsed properly and all of the indentation and formatting on my public key file is correct. When using eyaml to encrypt the private key, the formatting get screwed up and everything gets indented too far (actually, any indentation is too much) and openssl doesn't parse the private key properly. Here is an example of the eyaml I'm using. I'm pretty sure that the DEC(1)::PKCS7[ stuff is what's causing the indentation. Any idea on what the correct eyaml syntax is so that the information is not indented in my resulting private key file?

Is that the literal contents of your Hiera data yaml file, exactly as written in your source code? Other than the bogus private key contents, of course.

Is that the literal contents of your Hiera data yaml file, exactly as written in your source code? Other than the bogus private key contents, of course.

yes.

Oh, that's the decrypted file. Like from

eyaml edit <file>

?

The problem is that you're missing the

>

or

|

character after the yaml key's name.

yeah. There's a "|" that I forgot in there.