puppet agent can't obtain catalogs
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
puppet (Ubuntu) |
Expired
|
Low
|
Unassigned |
Bug Description
For puppet 2.7.1-1ubuntu3.
This is a dangerous bug as it appears when following the instructions in the server guide for installing puppet and is just silent, in the sense that there is nothing normally in the logs. It only appear if one checks whether the changes are being propagated or runs the puppet agent with a command like:
sudo puppetd agent --no-daemonize --verbose --debug
which will show something like:
err: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=SSLv3 read server session ticket A: sslv3 alert bad certificate
notice: Using cached catalog
err: Could not retrieve catalog; skipping run
after retrieving the signed ca certificate.
It is NOT due to a problem with time syncing, as can be verified by checking the validity time of the certificate with a command like:
sudo openssl x509 -text -noout -in /etc/puppet/
and ensuring that the not before time lies in the future.
It is likely due to an inability of the ruby puppet application to properly verify the ca certificate. See for example this now closed bug at puppetlabs:
http://
This page contains a fair amount of useful information about puppet's use of certificates:
http://
no longer affects: | maverick-backports |
Changed in puppet (Ubuntu): | |
importance: | Undecided → Low |
Thank you for taking the time to report this bug and helping to make Ubuntu better.
Maverick was end of lifed on April 10, 2012, but the same upstream version is being used on Lucid, Natty and Oneiric. Could you please check to see if this bug exists in the current stable release (Oneiric)?
And which version of puppetmaster are you running?
Thanks!