Re: [Puppet Users] Re: Updates to CA command line interaction in Puppet 6

2018-10-01 Thread Simon Tideswell
Hello Henri I suspect you've already had this answered, but I just replaced the offending stanza ... *allow: {* * extensions: {* * pp_cli_auth: "true"* * }* *}* with *allow: "the.fqdn.of.my.puppetserver"* I actually have a number of Puppet servers serving different clients and s

Re: [Puppet Users] PUPPET 6.0 : CSR from master does not match the agent public key

2018-10-01 Thread Maggie Dreyer
The new `puppetserver ca` tool makes requests to the CA API (specifically the `certificate_status(es)` endpoints), using the master's host cert for authorization. The master's cert is created with a special extension authorizing it to talk to those endpoints, allowed via a rule in `auth.conf`. A pe

Re: [Puppet Users] PUPPET 6.0 : CSR from master does not match the agent public key

2018-10-01 Thread Andy Hall
Hi Maggie - thanks for the reply. When I run the new command this is what we get : # puppetserver ca clean --certname andy-puppet6-test.london.company.com Error: When attempting to revoke certificate 'andy-puppet6-test.london.company.com', received: code: 403 body: Forbidden requ