Wow, the other respondents made this somewhat complicated.
I do this right now. Our "development" puppetmaster handles a bunch of
machines, but it itself is managed by our "production" puppetmaster.
We didn't do all this certificate juggling. The development
puppetmaster (puppet.dev.internal) has server = puppet.prod.internal
in it's puppet.conf, while the machines that point to the development
puppetmaster all have server = puppet.dev.internal in their
puppet.conf.
--Paul
On Tue, Sep 8, 2009 at 9:24 AM, Keith Edmunds<k...@midnighthax.com> wrote:
>
> Is is possible to have a puppetmaster that is a client of a different
> puppetmaster? We manage our customers' server via puppet, but one customer
> has a puppetmaster server which looks after their internal systems. We've
> tried the following in /etc/puppet/puppet.conf ("customer" and "us"
> replacing the domain names) on their puppetmaster:
>
> [puppetmasterd]
> certname = puppetmaster.customer.com
> templatedir=/var/lib/puppet/templates
>
> [puppetd]
> server = puppetmaster.us.com
> certname = puppetmaster.us.com
>
> When we run "puppetd -t" on that server, we get:
>
> # puppetd -t
>
> warning: Certificate validation failed; consider using the certname
> configuration option
>
> err: Could not retrieve catalog: Certificates were not trusted:
> SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B:
> certificate verify failed
>
> warning: Not using cache on failed catalog
>
> Is there a way around this?
>
> Thanks,
> Keith
>
> >
>
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To post to this group, send email to puppet-users@googlegroups.com
To unsubscribe from this group, send email to
puppet-users+unsubscr...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en
-~----------~----~----~----~------~----~------~--~---
