Puppet7主客户端hostname与证书不匹配问题排查求助

问题背景 #

在两台VirtualBox虚拟机上部署Puppet7主节点和客户端，启动客户端时出现证书匹配错误：

Server hostname 'puppetmaster' did not match server certificate; expected one of puppetmaster.

主节点上查看证书列表，发现签名证书名称末尾带点：

sudo /opt/puppetlabs/bin/puppetserver ca list --all 
Signed Certificates:
    puppetmaster.   

尝试修复时遇到的错误 #

执行清理证书命令时出现报错：

mark@puppetmaster:~$ puppetserver ca clean --certname puppetmaster.
Traceback (most recent call last):
    9: from /opt/puppetlabs/server/apps/puppetserver/cli/apps/ca:5:in `<main>'
    8: from /opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/puppetserver-ca-2.3.6/lib/puppetserver/ca/cli.rb:100:in `run'
    7: from /opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/puppetserver-ca-2.3.6/lib/puppetserver/ca/action/clean.rb:91:in `run'
    6: from /opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/puppetserver-ca-2.3.6/lib/puppetserver/ca/action/clean.rb:103:in `clean_certs'
    5: from /opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/puppetserver-ca-2.3.6/lib/puppetserver/ca/action/clean.rb:103:in `new'
    4: from /opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/puppetserver-ca-2.3.6/lib/puppetserver/ca/certificate_authority.rb:26:in `initialize'
    3: from /opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/puppetserver-ca-2.3.6/lib/puppetserver/ca/certificate_authority.rb:26:in `new'
    2: from /opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/puppetserver-ca-2.3.6/lib/puppetserver/ca/utils/http_client.rb:25:in `initialize'
    1: from /opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/puppetserver-ca-2.3.6/lib/puppetserver/ca/utils/http_client.rb:156:in `make_store'
/opt/puppetlabs/puppet/lib/ruby/vendor_gems/gems/puppetserver-ca-2.3.6/lib/puppetserver/ca/utils/http_client.rb:156:in `add_file': system lib (OpenSSL::X509::StoreError)
mark@puppetmaster:~$ sudo puppetserver ca clean --certname puppetmaster.
[sudo] password for mark: 
sudo: puppetserver: command not found

执行命令后问题仍未解决 #

切换到root用户执行清理和重新生成证书命令后，错误证书仍未被移除：

mark@puppetmaster:~$ sudo -i
[sudo] password for mark: 
root@puppetmaster:~# puppetserver ca clean --certname puppetmaster.
Certificate for puppetmaster. has been revoked
Cleaned files related to puppetmaster.
root@puppetmaster:~# puppet ssl clean
Notice: Removed private key /etc/puppetlabs/puppet/ssl/private_keys/puppetmaster..pem
Notice: Removed public key /etc/puppetlabs/puppet/ssl/public_keys/puppetmaster..pem
Notice: Removed certificate /etc/puppetlabs/puppet/ssl/certs/puppetmaster..pem
root@puppetmaster:~# puppet resource service puppetserver ensure=stopped
Notice: /Service[puppetserver]/ensure: ensure changed 'running' to 'stopped'
service { 'puppetserver':
  ensure   => 'stopped',
  provider => 'systemd',
}
root@puppetmaster:~# puppetserver ca generate --certname puppetmaster --ca-client
Successfully saved certificate for puppetmaster to /etc/puppetlabs/puppet/ssl/certs/puppetmaster.pem
Successfully saved certificate for puppetmaster to /etc/puppetlabs/puppetserver/ca/signed/puppetmaster.pem
Successfully saved private key for puppetmaster to /etc/puppetlabs/puppet/ssl/private_keys/puppetmaster.pem
Successfully saved public key for puppetmaster to /etc/puppetlabs/puppet/ssl/public_keys/puppetmaster.pem
root@puppetmaster:~# puppet resource service puppetserver ensure=running
Notice: /Service[puppetserver]/ensure: ensure changed 'stopped' to 'running'
service { 'puppetserver':
  ensure   => 'running',
  provider => 'systemd',
}
root@puppetmaster:~# sudo /opt/puppetlabs/bin/puppetserver ca list --all
Signed Certificates:
    puppetmaster.       (SHA256)  0B:E3:DC:2D:52:27:D9:D9:A1:18:9D:AB:74:07:50:86:E5:7C:32:5C:6F:A1:23:75:3D:4C:C3:90:7D:4D:08:BF   alt names: ["DNS:puppet", "DNS:puppetmaster."]  authorization extensions: [pp_cli_auth: true]
    puppetmaster        (SHA256)  06:EF:8C:3C:6D:83:CA:7A:C9:A4:39:02:DA:7B:F5:E6:D4:3C:27:B3:80:82:EB:4D:C0:92:99:37:F3:D2:96:F2   alt names: ["DNS:puppetmaster"] authorization extensions: [pp_cli_auth: true]
root@puppetmaster:~# sudo /opt/puppetlabs/bin/puppetserver ca sign --all 
Error:
    No waiting certificate requests to sign

客户端仍报相同错误：

mark@puppetclient:~$ sudo systemctl status puppet 
[sudo] password for mark: 
● puppet.service - Puppet agent
     Loaded: loaded (/lib/systemd/system/puppet.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2023-01-16 16:53:07 UTC; 1min 6s ago
       Docs: man:puppet-agent(8)
   Main PID: 654 (puppet)
      Tasks: 1 (limit: 2237)
     Memory: 83.4M
        CPU: 1.485s
     CGroup: /system.slice/puppet.service
             └─654 /opt/puppetlabs/puppet/bin/ruby /opt/puppetlabs/puppet/bin/puppet agent --no-daemonize

Jan 16 16:53:07 puppetclient systemd[1]: Started Puppet agent.
Jan 16 16:53:13 puppetclient puppet-agent[654]: Starting Puppet client version 7.21.0
Jan 16 16:53:13 puppetclient puppet-agent[654]: Server hostname 'puppetmaster' did not match server certificate; expected one of puppetmaster., DNS:puppet, DNS:puppetmaster.

最终解决步骤 #

1. 彻底清理主节点的错误证书 #

由于自动清理未完全移除旧证书，手动删除相关文件：

# 停止puppetserver服务
puppet resource service puppetserver ensure=stopped

# 删除旧证书的残留文件
rm -rf /etc/puppetlabs/puppetserver/ca/signed/puppetmaster..pem
rm -rf /etc/puppetlabs/puppetserver/ca/crl/puppetmaster..pem
# 若存在证书请求文件也一并删除
rm -rf /etc/puppetlabs/puppetserver/ca/requests/puppetmaster..pem

# 重新生成不带末尾点的主节点证书
puppetserver ca generate --certname puppetmaster --ca-client

# 启动puppetserver服务
puppet resource service puppetserver ensure=running

2. 重置客户端证书并重新请求 #

在客户端执行：

# 停止puppet服务
sudo systemctl stop puppet

# 清理客户端本地所有证书文件
sudo puppet ssl clean

# 重启服务触发新的证书请求
sudo systemctl start puppet

3. 主节点签署客户端证书 #

回到主节点，查看待签署请求并完成签署：

# 列出待签署的证书请求
sudo /opt/puppetlabs/bin/puppetserver ca list

# 签署客户端证书（替换为你的客户端名称）
sudo /opt/puppetlabs/bin/puppetserver ca sign --certname puppetclient

4. 验证连接有效性 #

在客户端执行测试命令，确认连接正常：

sudo puppet agent --test

内容的提问来源于stack exchange，提问作者markhorrocks