Puppet Agent无法从Puppet Server获取证书的问题求助

Agent端执行情况 #

在Puppet Agent执行命令 puppet ssl bootstrap，输出如下：

Info: 加载csr_attributes文件，路径为/home/mkhan244/.puppetlabs/etc/puppet/csr_attributes.yaml
Info: 为puppet-client1.mkhan244.ops创建新的SSL证书请求
Info: 证书请求指纹(SHA256): A6:6B:DE:23:C4:28:22:6A:E1:55:A6:C1:5E:AF:9C:31:21:5F:FC:B8:0D:6A:AA:7E:40:4D:F8:3F:5B:59:96:1F
Info: puppet-client1.mkhan244.ops的证书尚未签署
无法从CA服务器获取证书；你可能仍需要签署该代理的证书(puppet-client1.mkhan244.ops)。
Info: 将在120秒后重试。

Server端报错信息 #

在Puppet Server执行命令 puppetserver ssl sign --all，报错如下：

Traceback (most recent call last):
    8: from /opt/puppetlabs/server/apps/puppetserver/cli/apps/ca:5:in `<main>'
    7: from /opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/puppetserver-ca-2.4.0/lib/puppetserver/ca/cli.rb:100:in `run'
    6: from /opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/puppetserver-ca-2.4.0/lib/puppetserver/ca/action/sign.rb:68:in `run'
    5: from /opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/puppetserver-ca-2.4.0/lib/puppetserver/ca/action/sign.rb:68:in `new'
    4: from /opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/puppetserver-ca-2.4.0/lib/puppetserver/ca/certificate_authority.rb:26:in `initialize'
    3: from /opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/puppetserver-ca-2.4.0/lib/puppetserver/ca/certificate_authority.rb:26:in `new'
    2: from /opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/puppetserver-ca-2.4.0/lib/puppetserver/ca/utils/http_client.rb:25:in `initialize'
    1: from /opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/puppetserver-ca-2.4.0/lib/puppetserver/ca/utils/http_client.rb:156:in `make_store'
/opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/puppetserver-ca-2.4.0/lib/puppetserver/ca/utils/http_client.rb:156:in `add_file': system lib (OpenSSL::X509::StoreError)

问题分析与解决步骤 #

这个OpenSSL::X509::StoreError错误通常和Puppet Server的SSL证书存储、权限或文件损坏有关，可按以下步骤排查修复：

• 检查CA文件权限
  确保Puppet SSL目录及文件的权限归属puppet用户：

  chown -R puppet:puppet /etc/puppetlabs/puppet/ssl/
  chmod -R 0750 /etc/puppetlabs/puppet/ssl/
  

• 验证CA证书完整性
  检查CA证书是否正常：

  openssl x509 -in /etc/puppetlabs/puppet/ssl/ca/ca_crt.pem -text -noout
  

  如果命令报错，说明CA证书损坏，需重新生成CA（注意：此操作会使现有代理证书失效，需重新签署）：

  puppetserver ca clean --all
  puppetserver setup
  

• 重启Puppetserver服务

  systemctl restart puppetserver
  

• 重新发起Agent证书请求
  在Agent端清理旧请求后重新执行bootstrap：

  puppet ssl clean
  puppet ssl bootstrap
  

• 再次尝试签署证书
  回到Server端执行签署命令：

  puppetserver ssl sign --all
  

内容的提问来源于stack exchange，提问作者Pastor Munashe Zimondi