Andrew Meyer via FreeIPA-users wrote:
Ok now I am trying to add puppet to my FreeIPA environment.
Following
the instructions
from:
https://www.freeipa.org/page/Howto/Using_FreeIPA_CA_for_Puppet
Sadly most instructions don't include the versions(s) they were intended
for but Fedora 19 had IPA 3.2.x
I am getting the following error:
[root@asm-automation01 ~]# ipa service-add
puppetmaster/asm-automation01.mgt.asm.borg.local
ipa: ERROR: Host 'asm-automation01.mgt.asm.borg.local' does not have
corresponding DNS A/AAAA record
[root@asm-automation01 ~]# ipa service-add
puppetmaster/asm-automation01.mgt.asm.borg.local --force
ipa: ERROR: service with name
"puppetmaster/asm-automation01.mgt.asm.borg.local(a)MEYER.LOCAL" already
exists
Which just means you already created the service.
[root@asm-automation01 ~]# sudo vi /etc/puppetlabs/puppet/puppet.conf
Uh, ok.
[root@asm-automation01 ~]# ipa-getcert request -K
puppetmaster/asm-automation01.mgt.asm.borg.local -d /etc/httpd/alias -n
puppetmaster/asm-automation01.mgt.asm.borg.local
Certificate at same location is already used by request with nickname
"20171116140630".
Again, means you already did it.
[root@asm-automation01 ~]# puppet master --configprint hostcert
/var/lib/puppet/ssl/certs/asm-automation01.mgt.asm.borg.local.pem
/etc/puppetlabs/puppet/ssl/certs/asm-automation01.mgt.asm.borg.local.pem
[root@asm-automation01 ~]# puppet master --configprint hostprivkey
/var/lib/puppet/ssl/private_keys/asm-automation01.mgt.asm.borg.local.pem
/etc/puppetlabs/puppet/ssl/private_keys/asm-automation01.mgt.asm.borg.local.pem
[root@asm-automation01 ~]# puppet master --configprint localcacert
/var/lib/puppet/ssl/certs/ca.pem
/etc/puppetlabs/puppet/ssl/certs/ca.pem
[root@asm-automation01 ~]# certutil -L -d /etc/pki/nssdb -a -n "IPA
Machine Certificate - asm-automation01.mgt.asm.borg.local" >
/var/lib/puppet/ssl/certs/asm-automation01.mgt.asm.borg.local
certutil: Could not find cert: IPA Machine Certificate -
asm-automation01.mgt.asm.borg.local
: PR_FILE_NOT_FOUND_ERROR: File not found
[root@asm-automation01 ~]# puppet master --configprint localcacert
/var/lib/puppet/ssl/certs/ca.pem
/etc/puppetlabs/puppet/ssl/certs/ca.pem
[root@asm-automation01 ~]# certutil -L -d /etc/pki/nssdb -a -n "IPA
Machine Certificate - asm-automation01.mgt.asm.borg.local" >
/var/lib/puppet/ssl/certs/asm-automation01.mgt.asm.borg.local
certutil: Could not find cert: IPA Machine Certificate -
asm-automation01.mgt.asm.borg.local
: PR_FILE_NOT_FOUND_ERROR: File not found
[root@asm-automation01 ~]#
3.2 still generated a machine cert and this stopped happening early in
the 4.x installs.
The directions are flatly wrong. It first generates a cert stored in
/etc/httpd/alias and then instructs to get the cert of of /etc/pki/nssdb.
If you need a pem cert then get one. Don't mess around with converting
from an NSS database because in 2 years it expire and puppet will blow
up. Use this instead:
# ipa-getcert request -K
puppetmaster/puppetmaster.example.com -f
var/lib/puppet/ssl/certs/asm-automation01.mgt.asm.borg.local.pem -k
/var/lib/puppet/ssl/private_keys/asm-automation01.mgt.asm.borg.local.pem
rob