Puppet

I’m also running into this issue. My environment:

master: clean install of ubuntu 10.04, rvm ruby-1.9.2-p290, puppet 2.7.3
client: clean install of ubuntu 10.04, rvm ruby-1.9.2-p290, puppet 2.7.3

My setup script: https://gist.github.com/1161161

Downgrading to ruby-1.8.7-p352 under rvm seems to solve the issue. I have yet to try other versions of 1.9.2.

I am running into this issue while running on agent trying to connect to puppet master on puppet

root@agent:~# puppet agent --server puppet --waitforcert 60 --test
err: Could not request certificate: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed.  This is often because the time is out of sync on the server or client

My environment on both agent and puppet master are identical.

RubyGems Environment:
- RUBYGEMS VERSION: 1.8.10
- RUBY VERSION: 1.9.2 (2011-07-09 patchlevel 290) [x86_64-linux]
- INSTALLATION DIRECTORY: /usr/lib/ruby/gems/1.9.2
- RUBY EXECUTABLE: /usr/bin/ruby1.9.2
- EXECUTABLE DIRECTORY: /usr/bin
- RUBYGEMS PLATFORMS:
- ruby
- x86_64-linux
- GEM PATHS:
- /usr/lib/ruby/gems/1.9.2
- /root/.gem/ruby/1.9.2
- GEM CONFIGURATION:
- :update_sources => true
- :verbose => true
- :benchmark => false
- :backtrace => false
- :bulk_threshold => 1000
- REMOTE SOURCES:
- http://rubygems.org/

folks seem to have found a workaround

http://groups.google.com/group/puppet-users/msg/72bf694d4e2f3012

http://urgetopunt.com/puppet/2011/09/14/puppet-ruby19.html

Based on http://urgetopunt.com/puppet/2011/09/14/puppet-ruby19.html

scp user@puppetmaster://etc/puppet/ssl/certs/ca.pem /etc/puppet/ssl/certs/

ln -s /etc/puppet/ssl/certs/ca.pem /usr/lib/ssl/certs/$(openssl x509 -hash -noout -in /etc/puppet/ssl/certs/ca.pem).0

I got same problems with puppet 2.7.5 and ruby 1.9.2p188

I am facing the same problem. Workaround didn’t worked for me. I am using ruby 1.9.3.

Try:

scp user@puppetmaster:/etc/puppet/ssl/certs/ca.pem /etc/puppet/ssl/certs/
ln -s /etc/puppet/ssl/certs/ca.pem $(openssl version -d|cut -d\" -f2)/certs/$(openssl x509 -hash -noout -in /etc/puppet/ssl/certs/ca.pem).0

I ran into the same issue using RVM and ruby 1.9.2-p290. This works for me using 1.9.2-p180

Sorry spoke too soon, I got further with p180 but it did NOT work.

So yes, I CAN get this to work on 1.9.2-p180 using puppet -v 2.7.6. I’m going to try newer versions of 1.9.2 and puppet and see when this breaks.

I actually was able to make this work with 1.9.3-p0 and every version of puppet except for 2.7.10. So I’ll be sticking with 2.7.9 and 1.9.3-p0

Marcin Deranek wrote:

Try: […]

We are running CentOS 6.2 with openssl-1.0.0-20

The default part of the certificate to be hashed is changed so running

ln -s /etc/puppet/ssl/certs/ca.pem $(openssl version -d|cut -d\" -f2)/certs/$(openssl x509 -hash -noout -in /etc/puppet/ssl/certs/ca.pem).0    

will produce a different name of the link to the certificate in CentOS 6.

It should be changed to this instead if you are running on the new version:

ln -s /etc/puppet/ssl/certs/ca.pem $(openssl version -d|cut -d\" -f2)/certs/$(openssl x509 -subject_hash_old -noout -in /etc/puppet/ssl/certs/ca.pem).0    

Scott Wang wrote:

Marcin Deranek wrote:

Try: […]

We are running CentOS 6.2 with openssl-1.0.0-20

The default part of the certificate to be hashed is changed so running […] will produce a different name of the link to the certificate in CentOS 6.

It should be changed to this instead if you are running on the new version: […]

I found the opposite to be true. I’m using CentOS 6.2 with OpenSSL 1.0.0-20, but with Ruby 1.9.3.

On 5.7 and 5.8 w/ Ruby 1.9.3, the old hash is required. On 6.2 w/ Ruby 1.9.3, the new hash is required.

As a result: with 1.9.3 you always want -hash, not -subject_hash_old.