How to generate certificates for (secondary) compile puppetserver?

Question

I'm trying to scale puppetserver, in order to have redundancy, using round robin DNS. The secondary puppetserver (version 7.4.0) is configured to use the CA authority from primary puppetserver:

/etc/puppetlabs/puppet/puppet.conf:

[main]
ca_name = Puppet CA: puppet-ca-master.company.com
ca_server = puppet-ca-master.company.com
[agent]
server = puppet-ca-master.company.com
runinterval=1800

On the secondary server I've disabled CA service, as there could be only single certificate authority in /etc/puppetlabs/puppetserver/services.d/ca.cfg:

# To enable the CA service, leave the following line uncommented
# puppetlabs.services.ca.certificate-authority-service/certificate-authority-service
# To disable the CA service, comment out the above line and uncomment the line below
puppetlabs.services.ca.certificate-authority-disabled-service/certificate-authority-disabled-service
puppetlabs.trapperkeeper.services.watcher.filesystem-watch-service/filesystem-watch-service

I've removed certificates from the secondary, in order to fetch certificate signed certificate from the CA master:

rm -rf /etc/puppetlabs/puppet/ssl && mkdir -p /etc/puppetlabs/puppet/ssl/certs
chmod 0700 /etc/puppetlabs/puppet/ssl
chown -R puppet /etc/puppetlabs/puppet/ssl

However the puppetserver service refuses to start because of missing certificate:

2021-09-30T09:06:18.220+02:00 ERROR [async-dispatch-2] [p.t.internal] Error during service start!!!
java.lang.IllegalArgumentException: Unable to open 'ssl-cert' file: /etc/puppetlabs/puppet/ssl/certs/secondary-puppetserver.company.com.pem

When I try to run puppet agent -t on the secondary puppetserver it fails to sign the certificate:

Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (secondary-puppetserver.company.com)

Moreover the private key gets generated, but not a public one:

ll /etc/puppetlabs/puppet/ssl/public_keys/
total 0

score 0 · Accepted Answer · answered Sep 30 '21 at 12:11

With round robin DNS CA master config /etc/puppetlabs/puppetserver/conf.d/ca.conf needs to include:

allow-subject-alt-names: true

Restart puppetserver and generate certificates for secondary server on CA master:

puppetserver ca generate --certname puppet-secondary.company.com --subject-alt-names=puppet-secondary.company.com,puppet.company.com

transfer certificates:

rsync -a /etc/puppetlabs/puppet/ssl/private_keys/puppet-secondary.company.com.pem secondary-puppet:/etc/puppetlabs/puppet/ssl/private_keys/
rsync -a /etc/puppetlabs/puppet/ssl/certs/puppet-secondary.company.com.pem secondary-puppet:/etc/puppetlabs/puppet/ssl/certs/
rsync -a /etc/puppetlabs/puppet/ssl/public_keys/puppet-secondary.company.com.pem secondary-puppet:/etc/puppetlabs/puppet/ssl/public_keys/

and CA

rsync -ra /etc/puppetlabs/puppetserver/ca/{ca_crl.pem,ca_crt.pem} secondary-puppet:/etc/puppetlabs/puppetserver/ca/

On secondary make sure that CA service is disabled in /etc/puppetlabs/puppetserver/services.d/ca.cfg.

And make sure that webserver is configured to use correct certs /etc/puppetlabspuppetserver/conf.d/webserver.conf:

webserver: {
    access-log-config: /etc/puppetlabs/puppetserver/request-logging.xml
    client-auth: want
    ssl-host: 0.0.0.0
    ssl-port: 8140
    ssl-cert: /etc/puppetlabs/puppet/ssl/certs/puppet-secondary.company.com.pem
    ssl-key: /etc/puppetlabs/puppet/ssl/private_keys/puppet-secondary.company.com.pem
    ssl-ca-cert: /etc/puppetlabs/puppetserver/ca/ca_crt.pem
    ssl-crl-path: /etc/puppetlabs/puppetserver/ca/ca_crl.pem
}

On CA master DNS alt names could be verified. All puppet servers needs to include the same domain name and other unique name.

puppetserver ca list --all

look for alt names: ["DNS: ... . When certificate is generated using puppet agent, the alt names are not included.

How to generate certificates for (secondary) compile puppetserver?

1 Answers1