Ssl – Puppet unable to send facts to Foreman – “tlsv1 alert unknown ca”

foremanpuppetssl

I recently updated Katello to 2.2 and Foreman now to 1.8.1, so it appears somewhere in the upgrade that Puppet now cannot contact Foreman:

> [root@virt5 ~]# puppet agent --test info: 
> Retrieving plugin <snipped>
> err: Could not retrieve catalog from remote server: Error 400 on
> SERVER: Failed when searching for node virt5: Failed to find virt5.
> via exec: Execution of '/etc/puppet/node.rb virt5' returned 1:
> warning: Not using cache on failed catalog err: Could not retrieve
> catalog; skipping run

When running the same command on my puppetmaster I see:

[root@foreman certs]# /etc/puppet/node.rb virt5

Could not send facts to Foreman: SSL_connect returned=1 errno=0 state=SSLv3 read server session ticket A: tlsv1 alert unknown ca

I attempted to copy the /etc/pki/katello/certs/katello-default-ca.crt certificate being used by httpd to /etc/pki/ca-trust/source/anchors/ and then run update-ca-trust extract, but that does not appear to have made a difference.

I'm sure I'm missing something silly, I just am unsure as to what that would be.

Best Answer

One mistake I'm seeing here (that should be clearer in the documentation) is that you believe that Katello uses the Puppet certificates like Foreman, but it doesn't.

On the Foreman/Katello host run:

capsule-certs-generate --capsule-fqdn "mycapsule.example.com"\ 
                       --certs-tar "~/mycapsule.example.com-certs.tar"

Where mycapsule.example.com is your other Puppet master.

Unpack that tarball and copy over the "puppet-client" certificate RPM to your Puppet master, and install it

Copy some files around:

cp /etc/pki/katello-certs-tools/certs/*-puppet-client.crt /etc/puppet/foreman.crt
cp /etc/pki/katello-certs-tools/private/*-puppet-client.key /etc/puppet/foreman.key
cd /etc/puppet
wget https://katello.mydomain.net/pub/katello-default-ca.crt
chown puppet /etc/puppet/foreman.{crt,key} /etc/puppet/katello*

Configure your /etc/puppet/foreman.yaml like this:

:url: "https://katello.mydomain.net"
:ssl_ca: "/etc/puppet/katello-default-ca.crt"
:ssl_cert: "/etc/puppet/foreman.crt"
:ssl_key: "/etc/puppet/foreman.key"

That should hopefully do it.

Related Topic