Table of Contents

1. Challenge

   Replicate the Issue

   1. Install Puppet on the node1 Ubuntu node using the one-command installer:

       $ curl -k https://puppet.ec2.internal:8140/packages/current/install.bash | sudo bash
      

   2. On the master, attempt to approve the cert:

      $ sudo puppetserver ca sign --all
      

2. Challenge

   Discover the Root of the Issue

   1. Since we know that the node can connect to the Puppet master thanks to the installation command's success, we know the issue isn't related to a firewall or with any inter-node communications. So, let's see if our status message for the puppet service tells us anything (make sure to work from the node1 node):

       $ sudo systemctl status puppet | less
      

   2. Now, from the master, list the available cert information:

      $ sudo puppetserver ca list --all
      

      The output informs us of a revoked certificate's node that is identical to the one we've been working with. We've tracked down the problem!

3. Challenge

   Solve the Issue

   1. Clean the original cert from the master:

      $ sudo puppetserver ca clean --certname node1.ec2.internal
      

   2. Remove existing certificate information from the node1 node:

      $ sudo -i
      ~# rm -r $(puppet agent --configprint ssldir)
      

   3. Generate new certs for the node:

      ~# puppet agent -t
      

   4. Sign the cert on the master:

      $ sudo puppetserver ca sign --certname node1.ec2.internal
      

   5. It is optional, but we can confirm it worked by performing a puppet run against the node:

      ~# puppet agent -t