Puppet: Error: SSL_read:: shutdown while in init

Question

We are running Puppet master and agents version: 3.5.1

The puppet master is on RHEL 6.9 with OpenSSL 1.0.1e-fips 11 Feb 2013

And puppet agents WERE on Amazon Linux with OpenSSL 1.0.1k-fips 8 Jan 2015

After a yum update, the agents now have: OpenSSL 1.0.2k-fips 26 Jan 2017

After which, we've now started seeing the following puppet error:

...
Info: Applying configuration version 1508328365
Notice: /Stage[main]/Someservice/Somemodule::Instance[someservice]/File[/usr/local/somemodule/someservice.jar]/content: 
Binary files /usr/local/somemodule/someservice.jar and /tmp/puppet-file20171018-31408-194p0ni-0 differ
Error: SSL_read:: shutdown while in init
Error: /Stage[main]/Someservice/Somemodule::Instance[someservice]/File[/usr/local/somemodule/someservice.jar]/content: change from {md5}500bd479fe3d5b6c06f7912c9326ea8d to {md5}e85ee20d004783e85b0820b07d3537a9 failed: SSL_read:: shutdown while in init
...

At first I thought of upgrading the version of openssl on the server, but it would seem that the above is the latest for Redhat Enterprise 6.9.

This error only occurs when binary files differ (i.e. puppet needs to update jars or zip files).

I can only get things to work again, when we run a yum downgrade to the previous patch level on the client.

Anyone else seen this or have any other ideas?

Peter Souter Peter Souter · Accepted Answer · 2017-10-19T03:55:38

It seems like there was a breaking change brought in when updating OpenSSL with Puppet 3. Puppet 3 itself is EOL since December of 2016, so I recommend you update to Puppet 4 or even 5, which came out this year.

Another benefit: Puppet 4 and onward bundles it's own openssl, so you don't have to worry about breaking Puppet when upgrading openssl (See puppet-agent: What is it, and what's in it?)

You can do so with my helper script:

wget -O - https://raw.githubusercontent.com/petems/puppet-install-shell/master/install_puppet_agent.sh | sudo sh

Or manually:

Puppet 5

rpm -ivh http://yum.puppetlabs.com/puppet5/puppet5-release-el-6.noarch.rpm
yum install puppet-agent -y

Puppet 4

rpm -ivh http://yum.puppetlabs.com/puppetlabs-release-pc1-el-6.noarch.rpm
yum install puppet-agent -y

Puppet: Error: SSL_read:: shutdown while in init

2 Answers