概要

我不得不重build一个服务器，并遇到一个有趣的问题。 木偶拒绝validation证书，甚至在删除/ var / lib / puppet / ssl并清除主证书之后。

服务器

主：
操作系统：Ubuntu 14.04
木偶大师版本：3.4.3-1（使用Webrick）

代理：
操作系统：Ubuntu 12.04
木偶版本：2.7.11
（请注意，我在下面的输出中用“agent-server.com”replace了主机名）

复制步骤

• 删除代理服务器上的SSL目录：

  • 依赖关系User （失败）在Puppet清单中出现
  • 木偶模块安装忽略要求
  • 木偶：从清单目录安装文件
  • 木偶不拉Hiera价值
  • Ubuntu上的stream氓性能迅速降低，包括目录列表和Web应用程序

  rm -fr / var / lib / puppet / ssl

• 清理木偶大师的证书：

  puppet cert clean agent-server.com

• 重新启动木偶大师：

  /etc/init.d/puppetmaster重启

• 润木偶代理：

  傀儡代理人

错误消息：

代理：

root@agent-server:~# puppet agent -t info: Creating a new SSL key for agent-server.com info: Caching certificate for ca info: Creating a new SSL certificate request for agent-server.com info: Certificate Request fingerprint (md5): F2:2A:AD:3C:D5:E8:13:82:1D:C5:80:B4:FD:23:C4:86 info: Caching certificate for agent-server.com info: Caching certificate_revocation_list for ca err: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed. This is often because the time is out of sync on the server or client warning: Not using cache on failed catalog err: Could not retrieve catalog; skipping run err: Could not send report: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed. This is often because the time is out of sync on the server or client 

木偶大师

 [2017-08-29 18:08:51] 10.88.0.208 - - [29/Aug/2017:18:08:51 UTC] "GET /production/certificate/ca? HTTP/1.1" 200 1939 [2017-08-29 18:08:51] - -> /production/certificate/ca? [2017-08-29 18:08:51] 10.88.0.208 - - [29/Aug/2017:18:08:51 UTC] "GET /production/certificate/agent-server.com? HTTP/1.1" 404 78 [2017-08-29 18:08:51] - -> /production/certificate/agent-server.com? [2017-08-29 18:08:51] 10.88.0.208 - - [29/Aug/2017:18:08:51 UTC] "GET /production/certificate_request/agent-server.com? HTTP/1.1" 404 86 [2017-08-29 18:08:51] - -> /production/certificate_request/agent-server.com? [2017-08-29 18:08:51] 10.88.0.208 - - [29/Aug/2017:18:08:51 UTC] "PUT /production/certificate_request/agent-server.com HTTP/1.1" 200 1448 [2017-08-29 18:08:51] - -> /production/certificate_request/agent-server.com [2017-08-29 18:08:51] 10.88.0.208 - - [29/Aug/2017:18:08:51 UTC] "GET /production/certificate/agent-server.com? HTTP/1.1" 200 1448 [2017-08-29 18:08:51] - -> /production/certificate/agent-server.com? [2017-08-29 18:08:56] 10.88.0.208 - - [29/Aug/2017:18:08:56 UTC] "GET /production/certificate_revocation_list/ca? HTTP/1.1" 200 11220 [2017-08-29 18:08:56] - -> /production/certificate_revocation_list/ca? [2017-08-29 18:08:56] ERROR OpenSSL::SSL::SSLError: SSL_accept returned=1 errno=0 state=SSLv3 read client certificate A: sslv3 alert certificate revoked /usr/lib/ruby/vendor_ruby/puppet/network/http/webrick.rb:35:in `accept' /usr/lib/ruby/vendor_ruby/puppet/network/http/webrick.rb:35:in `block (2 levels) in listen' /usr/lib/ruby/1.9.1/webrick/server.rb:191:in `call' /usr/lib/ruby/1.9.1/webrick/server.rb:191:in `block in start_thread' [2017-08-29 18:08:56] ERROR OpenSSL::SSL::SSLError: SSL_accept returned=1 errno=0 state=SSLv3 read client certificate A: sslv3 alert certificate revoked /usr/lib/ruby/vendor_ruby/puppet/network/http/webrick.rb:35:in `accept' /usr/lib/ruby/vendor_ruby/puppet/network/http/webrick.rb:35:in `block (2 levels) in listen' /usr/lib/ruby/1.9.1/webrick/server.rb:191:in `call' /usr/lib/ruby/1.9.1/webrick/server.rb:191:in `block in start_thread 

因此，从日志来看，它看起来像证书正在被撤销，即使它是一个全新的。 另外，由于两台服务器距离非常近，所以不可能是时间问题，相隔2-3秒。

不幸的是我很难过。 任何帮助表示赞赏。