Puppet Community

The CRLs have been updated on the compilers but I believe that was done after the agent has checked in and possibly several CRL versions later.

The node will not know it has been revoked, but the primary and compilers know and decline the check in. So decommission it or clean up the host certificates and sign the node node again. 

thats the weird bit... The agent can still check in against the complilers and still sends reports to the PuppetDB... Its just that the CA has no idea that it issued the Cert.

typically our compilers and primary server are in noop. So I am assuming its related to the fact that the compilers haven't updated the CRL.

The regular agent runs executed by the `puppet` service on compilers sync changes to the CRL on the primary.

So, revocation becomes effective within 30 minutes with the default `runinterval`.