https://www.puppet.com/community logo
Join Slack
Powered by
# puppet
  • n
    Yup. That’s a Ruby version mismatch. I’d bet you’re on an old version of Puppet yet using the latest version of the mount_core module.
  • k
    i am puppet version 5.5.I would have expected it to fail all the time.I’ll try an upgrade.
  • n
    Hmm… that’s an error from the Puppetserver during catalog compilation. Do you have more than one Puppetserver?
  • b
    or different environments or a recently updated module?
  • n
  • s
    message has been deleted
  • g
    I am totally lost after missing the pe-puppetserver ca certificate validity ended yesterday. 
    puppet infrastructure run regenerate_master_certificate
    and also 
    regenerate_agent_certificate
    does not work. 
    rebuild_certificate_authority
    seemed to work, but now pe-puppetmaster does not start anymore: 
    An illegal reflective access operation has occurred
    ...
    /etc/puppetlabs/puppet/ssl/certs/blabla.pem (No such file or directory)
    This is pe-puppetserver 2019.8.10 and puppet agent 6.26.0 I cannot find documentation for this situation.
  • v
    Since it's a PE, open a support ticket, they will assist you. But since CA has expired, I think you need 
    puppet infrastructure run rebuild_certificate_authority
  • v
    Although, there are ways to extend in a less destructive way
  • v
    puppetlabs/ca_extend
  • d
  • s
    This message was deleted.
    v
    a
    • 3
    • 2
  • v
    message has been deleted
  • g
    Thank you, ca_extend looks promising. Although I'm stuck again when executing 
    bolt plan run ca_extend::extend_ca_cert regen_primary_cert=true --targets <local://blabla> compilers=blabla --run-as root
    It works up to this: 
    INFO: Extending CA certificate on <local://blabla>
    Starting: task ca_extend::extend_ca_cert on <local://blabla>
    Finished: task ca_extend::extend_ca_cert with 1 failure in 1.54 sec
    Finished: plan ca_extend::extend_ca_cert in 8.36 sec
    Then I get this error: 
    Failed on <local://blabla>:
    The task failed with exit code 1
    {
    "status": "error",
    "message": "Error extending CA certificate expiry date",
    "stderr": "CA certificate file: /etc/puppetlabs/puppet/ssl/ca/ca_crt.pem CA private key file: /etc/puppetlabs/puppet/ssl/ca/ca_key.pem  Checking CA chain length... 2 certificates were found in: /etc/puppetlabs/puppet/ssl/ca/ca_crt.pem This script only works on CA files that contain a single certificate. "
    }
  • g
    Thank you, ca_extend looks promising. Although I'm stuck again when executing 
    bolt plan run ca_extend::extend_ca_cert regen_primary_cert=true --targets <local://blabla> compilers=blabla --run-as root
    It works up to this: 
    INFO: Extending CA certificate on <local://blabla>
    Starting: task ca_extend::extend_ca_cert on <local://blabla>
    Finished: task ca_extend::extend_ca_cert with 1 failure in 1.54 sec
    Finished: plan ca_extend::extend_ca_cert in 8.36 sec
    Then I get this error: 
    Failed on <local://blabla>:
    The task failed with exit code 1
    {
    "status": "error",
    "message": "Error extending CA certificate expiry date",
    "stderr": "CA certificate file: /etc/puppetlabs/puppet/ssl/ca/ca_crt.pem CA private key file: /etc/puppetlabs/puppet/ssl/ca/ca_key.pem  Checking CA chain length... 2 certificates were found in: /etc/puppetlabs/puppet/ssl/ca/ca_crt.pem This script only works on CA files that contain a single certificate. "
    }
  • v
    oh, yeah, there is that :(
  • g
    Shall I simply delete one of the two certs in ca_crt.pem?
  • v
    I wouldn't. 
    rebuild_certificate_authority
    is probably your best bet
  • v
    Although I am surprised a CA with intermediate CA already expired. I thought PE started to generate 20+ years certs when switched to it
  • g
    I already did a 
    puppet infrastructure run rebuild_certificate_authority
    which did not help. Now I deleted one of the two certs and ca_extend runs to the end but still has a key verification error (fingerprint unknown): 
    Starting: task service::linux on blabla
    Finished: task service::linux with 1 failure in 0.13 sec
    Finished: plan ca_extend::extend_ca_cert in 1 min, 21 sec
    Failed on blabla:
    Host key verification failed for blabla: fingerprint SHA256:XYZ123/..... is unknown for "blabla,1.2.3.4"
  • v
    Did you try?
    Copy code
    puppet infrastructure run rebuild_certificate_authority force=true
  • g
    force=true does not work (invalid option). The rebuild ran without error though, but afterwards, pe-puppetserver does no more start (An illegal reflective access operation has occurred)
  • v
    strange, what version of PE do you have?
  • g
    2019.8.0.37
  • v
    you need to 
    puppet infrastructure run regenerate_master_certificate
    too
  • v
    I have 2019.8.10, parameter is there
  • v
    Copy code
    plan enterprise_tasks::rebuild_ca(
  Optional[TargetSpec] $master          = 'localhost',
  Optional[Boolean] $manage_pxp_service = true,
  Optional[Boolean] $force              = false,
) {
  • g
    where is this plan? i.e. where do I enter these parameters? in ca_extend 
    bolt plan show
    does not list 
    enterprise_tasks
  • v
    you would run it from your CA server, and you use puppet infrastructure run instead of bolt, sorry
  • v
    you need to 
    puppet infrastructure run regenerate_master_certificate
    too
1...262728...428Latest