Try this and see, It might help.

         0) Stop puppetdb
1) remove PuppetDB's SSL directory entirely (usually /etc/puppetdb/ssl)
2) make sure that the agent on the puppetdb machine can run successfully
against the master (puppet agent --test, sounds like you've already done
3) Run the puppetdb-ssl-setup script (which should be in your sbin
4) Restart puppetdb

On Tuesday, August 27, 2013 8:58:27 PM UTC-4, Stephen Wallace wrote:

Hmmmm....an outstanding bug - http://projects.puppetlabs.com/issues/20838

On Tuesday, 27 August 2013 17:45:28 UTC+10, Stephen Wallace wrote:


I'm trying to layer out PE3 as follows;

1) Puppet console / Active CA (autosigning)
2) Puppet Master (non-CA)
3) PuppetDB
4) Puppet Client - for testing
5) HAProxy presenting the puppet service address, forwarding 443 to the
console, and 8140 to the PM. (Let's not worry about MCollective yet)

The PM and PuppetDB both had their certs signed against the Console / CA,
and both can do a puppet agent -t

I've setup the SSL proxying on the PM1 as follows;

# Enable SSLProxyEngine for proxying SSL connections
SSLProxyEngine On
# Disable PassengerHighPerformance because of proxy_http -%>
PassengerHighPerformance Off
# Add the mod_proxy redirect -%>
ProxyPassMatch ^/([^/]+/certificate.*)$
# ProxyPassReverse ^/([^/]+/certificate.*)$

When I initially run puppet agent -t on the client, the CSR is generated,
and signed on the CA. There are errors all subsequent runs from the client;

[root@puppetclient puppet]# /opt/puppet/bin/puppet agent -t
Warning: Unable to fetch my node definition, but the agent run will
Warning: Error 400 on SERVER: Could not retrieve facts for
puppetclient.puppetlabs.net: Failed to find facts from PuppetDB at
puppetdb.puppetlabs.net:8081: SSL_connect SYSCALL returned=5 errno=0
state=SSLv3 read finished A
Info: Retrieving plugin
Info: Loading facts in /var/opt/lib/pe-puppet/lib/facter/puppet_vardir.rb
( snip)
Info: Loading facts in
Info: Loading facts in /var/opt/lib/pe-puppet/lib/facter/concat_basedir.rb
Error: Could not retrieve catalog from remote server: Error 400 on
SERVER: Failed to submit 'replace facts' command for
puppetclient.puppetlabs.net to PuppetDB at puppetdb.puppetlabs.net:8081:
SSL_connect SYSCALL returned=5 errno=0 state=SSLv3 read finished A
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run

The error appears to be an SSL issue associated with talking to PuppetDB
as per the following entry in the puppetdb.log file.

[io.nio] javax.net.ssl.SSLHandshakeException: null cert chain

My java/jre stuff currently installed is as follows;

root@puppetdb:/var/log/pe-puppetdb# dpkg -l|grep jre
rc openjdk-6-jre-headless 6b27-1.12.6-1ubuntu0.12.04.2
OpenJDK Java runtime, using Hotspot JIT (headless)
rc openjdk-7-jre-headless 7u25-2.3.10-1ubuntu0.12.04.2
OpenJDK Java runtime, using Hotspot JIT (headless)
root@puppetdb:/var/log/pe-puppetdb# dpkg -l|grep java
rc ca-certificates-java 20110912ubuntu6 Common
CA certificates (JKS keystore)
ii java-common 0.43ubuntu2 Base
of all Java packages
ii pe-java
OpenJDK Development Kit (JDK)
ii tzdata-java 2012e-0ubuntu0.12.04.1 time
zone and daylight-saving time data for use by java runtimes

JAVA_HOME, or any of this sort of variable is not set in my env.

I did see this one which talks about the issue, but no resolutions?


Any assistance would be greatly appreciated!


You received this message because you are subscribed to the Google Groups "Puppet Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users+unsubscribe@googlegroups.com.
To post to this group, send email to puppet-users@googlegroups.com.
Visit this group at http://groups.google.com/group/puppet-users.
For more options, visit https://groups.google.com/groups/opt_out.

Search Discussions

Discussion Posts


Follow ups

Related Discussions

Discussion Navigation
viewthread | post
posts ‹ prev | 3 of 4 | next ›
Discussion Overview
grouppuppet-users @
postedAug 27, '13 at 7:45a
activeSep 25, '13 at 1:38p



site design / logo © 2022 Grokbase