Can't manage Puppet Certificates on the PuppetCA (404 error)

Question

I have just finished installing a Puppet / Foreman / PuppetDB stack. Here is the details :

OS : Centos 8.2

Puppetserver version : 6.12.1

PuppetDB version : 6.11.2

Puppet agent version : 6.17.0

Foreman version : 2.1

I have the PuppetCA and Foreman on one host, the Puppetmaster on a second one and the PuppetDB on a third one. I used Foreman-installer to install everything except the PuppetDB.

It took me quite some time but it seems to be working fine except for one thing, I can't manage the nodes certificates because the following command gives me a 404 error (I run it on the PuppetCA/Foreman host) :

> puppetserver ca list --all
Error:
    code: 404
    body: {
"message":"Not Found",
"url":"/puppet-ca/v1/certificate_statuses/any_key",
"status":"404"
}
No certificates to list

I did set up the autosign with my servers domain name, so the new nodes get their certificate request correctly signed, they get their catalogs, I see them in Foreman etc...

> ls -l  /etc/puppetlabs/puppet/ssl/ca/signed/
total 44
drwxr-x---. 2 puppet puppet 4096 Aug 24 18:01 .
drwxr-x---. 4 puppet puppet  232 Aug 24 18:35 ..
-rw-r--r--. 1 puppet puppet 1960 Aug 24 18:01 host1.domain.local.pem
-rw-r--r--. 1 puppet puppet 1968 Aug 24 16:45 host2.domain.local.pem
-rw-r--r--. 1 puppet puppet 1968 Aug 23 11:39 host3.domain.local.pem
-rw-r--r--. 1 puppet puppet 1968 Aug 23 11:42 host4.domain.local.pem
...

But I need to revoke and renew some of these certificates so for the moment, I am blocked.

I don't know where to look, any help would be appreciated ^^

Thanks

On which machine are you trying to use the puppetserver ca command? — John Bollinger
And are you even using Puppet's CA? I'm uncertain what Foreman actually would do to achieve the configuration you describe, but when Puppet is configured to use an external CA, that CA does not need to be another Puppet server. — John Bollinger
I use the puppetserver ca command on the machine that hosts both foreman and the puppet CA. Now that I think about it, having both the puppet CA and Foreman on the same host is probably not the best idea... — Toad

Toad Toad · Accepted Answer · 2020-08-26T07:38:32

I was missing the "ca_server" parameter in the "main" section of the machine that hosts Foreman and the PuppetCA. I used the hostname of the server for the value and the "puppetserver ca" command worked.

Thanks for the answers and help

Can't manage Puppet Certificates on the PuppetCA (404 error)

1 Answers