2

After installing puppet master and client, when I request for catalog, I am getting the following error:

[root@INFINI-ONE puppet]# puppet agent -t
warning: peer certificate won't be verified in this SSL session
info: Caching certificate for infini-one.infinicluster
err: Could not retrieve catalog from remote server: Error 400 on SERVER: No 
support for http method POST
warning: Not using cache on failed catalog
err: Could not retrieve catalog; skipping run

And later:

[root@INFINI-ONE puppet-2.7.14]# puppet agent -t
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
info: Caching certificate for infini-one.infinicluster
err: Could not retrieve catalog from remote server: SSL_connect returned=1 
errno=0 state=SSLv3 read server certificate B: certificate verify failed.  This 
is often because the time is out of sync on the server or client
warning: Not using cache on failed catalog
err: Could not retrieve catalog; skipping run
err: Could not send report: SSL_connect returned=1 errno=0 state=SSLv3 read 
server certificate B: certificate verify failed.  This is often because the 
time is out of sync on the server or client
  • Are you sure the puppet master's certificate authority is signing the client's SSL certificate? Does running puppetca sign --all on the puppet master help? – Joseph R. Oct 12 '13 at 7:37
1

Are the client and the server the same puppet version? This can be especially important to verify if you're using two different OSes.

You may find this link helpful: http://bitcube.co.uk/content/puppet-errors-explained

  • yes now i am facing another error, i am updating that – jagdish Jun 4 '13 at 15:36
  • Are you running ntp? If not, can you run ntpdate pool.ntp.org on both servers? – zje Jun 4 '13 at 15:38
  • i am not knowing much about ntp, but i tried command u told on both systems, i got following result master: 4 Jun 21:13:21 ntpdate[4172]: the NTP socket is in use, exiting agent: 4 Jun 21:15:28 ntpdate[13706]: no server suitable for synchronization found – jagdish Jun 4 '13 at 15:44
  • seems like an ntp server is running on the master. Can you install ntp on the agent and configure it to point to the master (e.g. server MASTERIP in /etc/ntp.conf)? – zje Jun 4 '13 at 15:55
1

This is issue generally occurs when time between puppetmaster and client is out of sync.

Have you checked the timings on both the server are same?

If the client is behind when the certificate was generated, then the client sees that the start date of the certificate is in the future and therefore is invalid.

  • 1
    For this reason it's usually recommended to set up an NTP server on the puppet master and have the clients sync to it. This is the setup we currently have at work. – Joseph R. Sep 12 '13 at 10:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.