Project

General

Profile

ERF12-7740 » History » Version 6

Andreas Pfaffeneder, 04/29/2015 02:02 AM

1 1 Dominic Cleal
h1. ERF12-7740
2
3
h2. Generic or SSL connection errors
4
5
Please see [[Proxy_communication_errors]] first for SSL or communication errors, which aren't specific to this particular proxy action.
6
7 3 Dominic Cleal
h2. Unable to delete PuppetCA certificate for ...
8 1 Dominic Cleal
9
Foreman will be contacting the smart proxy (responsible for Puppet CA management on that host) to request that the old certificate for the host is deleted.
10
11
Check /var/log/foreman-proxy/proxy.log on your Puppet CA server for any errors.
12
13
h2. Failed to run puppetca: [sudo] password for foreman-proxy
14
15
The proxy is trying to run a Puppet command to delete the certificate via sudo, but the sudoers rules aren't allowing it to do so without a password - suggesting the rules aren't right (they vary for Puppet 2 versus 3) or are missing.
16
17
See http://theforeman.org/manuals/latest/index.html#4.3.2SmartProxySettings, scroll down a little for the Puppet CA configuration and the sudoers rules are listed.  These should be in /etc/sudoers.d/foreman-proxy and the file should have @-r--r-----@ (0440) permissions.
18 2 Dominic Cleal
19 4 Anonymous
Note that if you've upgraded from Puppet 2 to 3, the rule needs changing to @/usr/bin/puppet cert *@ (you should also read the [[FAQ##Upgrade-puppet-from-v2-to-v3-gotchas]] for other changes, or re-run the installer).
20 5 Andreas Pfaffeneder
21
h2. Used Hashing Algorithms
22 6 Andreas Pfaffeneder
23 5 Andreas Pfaffeneder
Check that your client can and does support the chosen minimum hashing algorithm on your Foreman-installation. Issues can arise, if Puppet2 agent should talk to a recent Foreman with state of the art hashing algorithm like SHA256 as the old Puppet agent only supports MD5.