如何让Puppet提供适当的证书？

我想把我的木偶主人和我的木偶客户联系起来。我在证书方面遇到了麻烦。我最初尝试使用puppetmaster的IP地址（因为我们没有设置DNS），但现在我想当我设置一台新机器以将

puppet

映射到其IP时，我必须编辑主机文件

所以一旦我这么做了，我仍然有问题。一些背景：在master上，我曾多次尝试删除服务器证书并重新创建一个新证书。我认为这是造成问题的原因，因为日志上说它被撤销了

devtest

是傀儡代理

这就是我尝试测试代理时发生的情况

[root@devtest puppet]# puppet agent --test --server puppet
Warning: Unable to fetch my node definition, but the agent run will continue:
Warning: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [certificate revoked for /CN=servername.mydomain.com]
Info: Retrieving pluginfacts
Error: /File[/var/lib/puppet/facts.d]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [certificate revoked for /CN=servername.mydomain.com]
Error: /File[/var/lib/puppet/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet://puppet/pluginfacts: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [certificate revoked for /CN=servername.mydomain.com]
Wrapped exception:
SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [certificate revoked for /CN=servername.mydomain.com]
Info: Retrieving plugin
Error: /File[/var/lib/puppet/lib]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [certificate revoked for /CN=servername.mydomain.com]
Error: /File[/var/lib/puppet/lib]: Could not evaluate: Could not retrieve file metadata for puppet://puppet/plugins: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [certificate revoked for /CN=servername.mydomain.com]
Wrapped exception:
SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [certificate revoked for /CN=servername.mydomain.com]
Could not retrieve fact='ipaddress', resolution='<anonymous>': Could not execute 'host devtest': command not found
Could not retrieve fact='ipaddress', resolution='<anonymous>': Could not execute 'host devtest': command not found
Error: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [certificate revoked for /CN=servername.mydomain.com]
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run
Error: Could not send report: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [certificate revoked for /CN=servername.mydomain.com]

成功了。现在我重新启动Apache，并得到一个错误

systemctl status httpd.service

没有说任何有用的话，但是/var/log/httpd/puppet-server-example.com\u ssl\u error.log有：

[Fri Aug 01 18:48:49.383002 2014] [ssl:warn] [pid 25661] AH01906: RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Fri Aug 01 18:48:49.383028 2014] [ssl:warn] [pid 25661] AH01909: RSA certificate configured for servername.mydomain.com:8140 does NOT include an ID which matches the server name
[Fri Aug 01 18:48:49.383044 2014] [ssl:emerg] [pid 25661] AH02238: Unable to configure RSA server private key
[Fri Aug 01 18:48:49.383071 2014] [ssl:emerg] [pid 25661] SSL Library Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

---

此时，我只是猜测配置文件的设置应该是什么。我假设需要更改一些配置文件——Apache配置或Puppet配置，但此时我不确定正确的证书是什么。我有

/var/lib/puppet/ssl

和

/etc/puppet/ssl

中的证书

您的设置存在多个问题。你确实是对的，你需要这样做

为主机选择FQDN，并确保代理可以解析它

• 通过相应的

  主机

  文件或
• 通过

  dnsmasq

告诉主机使用该名称作为其SSL CN

首先，确保主机使用正确的名称。将其添加到主机上的

/etc/puppet/puppet.conf

：

[master]
certname=server.mydomain.com

重新启动主机。它应该为自己签署一份新的证书（注意它如何将

10.128.119.155

视为自己的名称，并将其用作CN-这是不明智的）

接下来，确保Apache使用此证书而不是CA证书

SSLCertificateFile /var/lib/puppet/ssl/certs/server.mydomain.com.pem

（您可以使用

puppet master--configprint ssldir

确保

/var/lib/puppet/ssl

是正确的路径）

---

你的主人现在应该有一个有效的证书。如果代理通过其FQDN到达它，SSL握手应该会成功。

那么主服务器或代理的FQDN也是如此。

但不幸的是，正如我所说，我们没有设置DNS，所以我不确定到底需要做什么才能使它工作。我已将

server.mydomain.com

添加到客户端的hosts文件中。我必须确保我是通过它连接到主机的，而不是IP地址。还有什么我需要做的吗？

SSLCertificateFile /var/lib/puppet/ssl/certs/server.mydomain.com.pem