傀儡设备无法获得本地颁发者证书

Question

我安装了傀儡4.3和centos7使用木偶设备来管理思科路由器。服务器主机名为“傀儡主机”(通过运行hostnamectl puppetmaster)，centos服务器正在运行傀儡主机和代理。

在我运行sudo傀儡设备--调试时，设置了所有内容并配置了device.conf之后，我看到了以下错误：

Error: /File[/opt/puppetlabs/puppet/cache/devices/r1/facts.d]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=puppetmaster]
Error: /File[/opt/puppetlabs/puppet/cache/devices/r1/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet:///pluginfacts: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=puppetmaster]

我可以在服务器上成功地运行puppet agent --test：

sudo puppet agent --test
Info: Using configured environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Info: Caching catalog for puppetmaster
Info: Applying configuration version '1449189804'

这是我的/etc/傀儡实验室/傀儡/device.conf

[r1]
type cisco
url telnet://puppet:123456@r1/

这是我的/etc/傀儡实验室/木偶/木偶。

[master]
vardir = /opt/puppetlabs/server/data/puppetserver
logdir = /var/log/puppetlabs/puppetserver
rundir = /var/run/puppetlabs/puppetserver
pidfile = /var/run/puppetlabs/puppetserver/puppetserver.pid
codedir = /etc/puppetlabs/code
dns_alt_names = puppetmaster

[agent]
certname = puppetmaster
server = puppetmaster

这一定是某种证书问题，比如名字错配，但我不知道是什么原因造成的。代理与主服务器运行在同一台服务器上，我正确地设置了所有的信任(至少我认为是这样)。

这是木偶归还的证书：

 sudo puppet cert --print --all | grep CN
        Issuer: CN=Puppet CA: puppetmaster
        Subject: CN=puppetmaster

下面是原始的ca.pem和puppetmaster.pem证书：

openssl x509 -in /etc/puppetlabs/puppet/ssl/certs/ca.pem -noout -text | grep CN
        Issuer: CN=Puppet CA: puppetmaster
        Subject: CN=Puppet CA: puppetmaster
                DirName:/CN=Puppet CA: puppetmaster
openssl x509 -in /etc/puppetlabs/puppet/ssl/certs/puppetmaster.pem -noout -text | grep CN
        Issuer: CN=Puppet CA: puppetmaster
        Subject: CN=puppetmaster

当我运行openssl来验证证书时，我会看到同样的错误：

sudo openssl verify -CApath /etc/puppetlabs/puppet/ssl/certs/ca.pem /etc/puppetlabs/puppet/ssl/certs/puppetmaster.pem

/etc/puppetlabs/puppet/ssl/certs/puppetmaster.pem: CN = puppetmaster
error 20 at 0 depth lookup:unable to get local issuer certificate

我确认了配置设置，并通过清洗证书的过程 (多次)，但没有骰子。

Answer 1

好的算出来了。

正如我说的，我清除并再生了木偶证书，但我没有做的是清楚的：

/opt/puppetlabs/puppet/cache/devices/

木偶为设备缓存了一个旧的证书，所以它试图使用这个证书，而不是生成一个新的证书。

删除该文件夹的内容后，我能够运行puppet device。