Troubleshooting Puppet Communication

Install Puppet on the node1 Ubuntu node using the one-command installer:

 $ curl -k https://puppet.ec2.internal:8140/packages/current/install.bash | sudo bash

On the master, attempt to approve the cert:

$ sudo puppetserver ca sign --all

Since we know that the node can connect to the Puppet master thanks to the installation command's success, we know the issue isn't related to a firewall or with any inter-node communications. So, let's see if our status message for the puppet service tells us anything (make sure to work from the node1 node):

 $ sudo systemctl status puppet | less

Now, from the master, list the available cert information:

$ sudo puppetserver ca list --all

The output informs us of a revoked certificate's node that is identical to the one we've been working with. We've tracked down the problem!

Clean the original cert from the master:

$ sudo puppetserver ca clean --certname node1.ec2.internal

Remove existing certificate information from the node1 node:

$ sudo -i
~# rm -r $(puppet agent --configprint ssldir)

Generate new certs for the node:

~# puppet agent -t

Sign the cert on the master:

$ sudo puppetserver ca sign --certname node1.ec2.internal

It is optional, but we can confirm it worked by performing a puppet run against the node:

~# puppet agent -t