The information on this page from the Puppet 5 docs will probably help: https://puppet.com/docs/puppetserver/5.3/intermediate_ca_configuration.html
Assuming your intermediate CA was set up using `puppetserver ca setup`, the important bits are: 1) Delete the SSL dir on the agent 2) Set CRL checking on the agent to "leaf" 3) Copy the CA bundle from the master to the agent: (master) /etc/puppetlabs/puppet/ssl/ca/ca_crt.pem -> (agent) /etc/puppetlabs/puppet/ssl/certs/ca.pem 4) Copy the CRL bundle from the master to the agent: (master) /etc/puppetlabs/puppet/ssl/ca/ca_crl.pem -> (agent) /etc/puppetlabs/puppet/ssl/crl.pem 5) Do an agent run to generate a CSR and proceed as usual You shouldn't have to create any bundles or do any work server-side if you used our CLI to build your intermediate CA (either with `setup` or `import). These steps are necessary because the agent used to not correctly save PEM files with more than one artifact in them (like the cert and CRL bundles here), and it also didn't used to properly iterate over a chain of CRLs even if it had one (hence setting CRL checking to leaf). Both of these issues are fixed in Puppet 6. Let me know if you have any more issues. I'll look into getting some of this information linked from the Puppet 6 version of the intermediate CA docs. On Thu, Oct 25, 2018 at 4:57 PM <choly...@redlands.qld.edu.au> wrote: > On Tuesday, 23 October 2018 01:37:10 UTC+10, Maggie Dreyer wrote: >> >> Puppet 5 agents do not properly support the intermediate CA setup without >> manual intervention. >> > > Hi Maggie, > > Could you elaborate on the "manual intervention" required to get a Puppet > 5 agent to work with the intermediate CA? I'm getting errors associated > with the CRL but can't yet find any discussion of this in the > documentation. I'm sure this is the incompatibility you mentioned. > > > Warning: SSL_connect returned=1 errno=0 state=error: certificate verify > failed: [unable to get certificate CRL for /CN=Puppet CA: > puppet.test.redlands.qld.edu.au] > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to puppet-users+unsubscr...@googlegroups.com. > To view this discussion on the web visit > https://groups.google.com/d/msgid/puppet-users/77597585-6a3c-48b2-b3f8-c1ca85bac715%40googlegroups.com > <https://groups.google.com/d/msgid/puppet-users/77597585-6a3c-48b2-b3f8-c1ca85bac715%40googlegroups.com?utm_medium=email&utm_source=footer> > . > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/CAMstjg3nu4yuHyiDrmbnr-AmCJ_8BNF3sa7np7p18xo81cgS%3Dw%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
