Puppet

Puppet currently keeps hold of it’s CSR, which is nice, however if the master returns a certificate which does not match the CSR, e.g. a previously signed certificate, the client cannot use it because it’s not tied to the new private key.

The problem arises on the second run of puppet, which thinks it already has a certificate, even though it’s un-usable.

Currently, I work around this problem with this very ugly script:

#!/bin/bash
#
# Try really hard to get a signed cert.
#
# Note: the CERT, Private Key, and Public Key env
# variables must match those specified in puppetd.conf
# currently, we don't parse that configuration file, so
# this script must match what puppet is configured to do.
#

PUPPETCONF="/Library/Puppet/Versioned/Client/config/puppet.network"
SSLDIR="/Library/Puppet/Generated/Client/SSL"
CERT="${SSLDIR}/host_cert.pem"
PRIKEY="${SSLDIR}/host_key.pem"
PUBKEY="${SSLDIR}/host_pub.pem"
CSR="${SSLDIR}/csr_$(hostname).pem"

# This function takes a cert as ARG1 and a private key as ARG2
# It challenges the private key by encrypting data to it with the cert.
function [[ValidCert]]()
{
    local CERT="$1"
    local KEY="$2"
    
    if [ ! -e "$CERT" -a ! -e "$KEY" ]; then
        return 1
    fi
    local CHALLENGE_FILE="/tmp/challenge_data.$$"
    # Sign some random data and verify it with the certificate
    dd if=/dev/random of="$CHALLENGE_FILE" bs=1k count=4 2> /dev/null
    openssl smime -sign -in "$CHALLENGE_FILE" -outform pem -text \
        -inkey "$PRIKEY" -signer "$CERT" \
        -out "$CHALLENGE_FILE".sig.pem >&2
    return $?
}

function [[CleanPuppetCert]]()
{
    [ -e "$CERT" ] && rm -f "$CERT"
}

function [[CleanPuppetKeys]]()
{
    [ -e "$PRIKEY" ] && rm -f "$PRIKEY"
    [ -e "$PUBKEY" ] && rm -f "$PUBKEY"
    [ -e "$CSR" ] && rm -f "$CSR"
}

function [[RunPuppet]]()
{
    echo "Requesting Certificate for $(hostname -s) ..."
    echo "%40 CSR"
    run_puppet_network.sh \
        --waitforcert 10 --onetime \
        --verbose --color=false \
        --tags certonly >&2
}

[[RunPuppet]]

while ! ValidCert "$CERT" "$PRIKEY"
do
    [[CleanPuppetCert]]
    echo "WARNING: Puppet Master returned the wrong cert.  Try cleaning!"
    SECS=60; DELAY=5;
    while [ $SECS -gt 0 ]; do
        echo "%40 Retry in ${SECS}s"
        sleep $DELAY
        ((SECS=$SECS - $DELAY))
    done
    [[RunPuppet]]
done
exit 0