Uploaded image for project: 'PuppetDB'
  1. PuppetDB
  2. PDB-346

Document SSL error: javax.net.ssl.SSLHandshakeException: null cert chain

    Details

    • Type: Task
    • Status: Closed
    • Priority: Normal
    • Resolution: Duplicate
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: DOCS
    • Labels:

      Description

      This bug report is a result of communicating with Ken via the mailing list: <https://groups.google.com/d/topic/puppet-users/877mzTGZl1A/discussion>.

      Find complete output including puppet.conf here: <http://pastebin.com/raw.php?i=TDejFAvp>.

      Whenever `puppet agent -t` was ran, the following error would be returned:

      Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Failed to submit 'replace facts' command for gaia.local
      to PuppetDB at puppetdb.local:8081: SSL_connect SYSCALL returned=5 errno=0 state=SSLv3 read finished A
      Warning: Not using cache on failed catalog
      Error: Could not retrieve catalog; skipping run
      

      Which only really means the SSL connection was cut-off early (newer versions of Puppet will give a more meaningful client error) ... looking in puppetdb.log we saw the error:

      WARN [qtp788652058-42] [io.nio] javax.net.ssl.SSLHandshakeException: null cert chain
      

      The problem was the following:

      • For everything puppet, I use puppet.local as the fqdn for the puppet master.
      • The actual hostname (and thus the cert) for the puppet master node is gaia.local.
      • For some reason (config probably ), puppet agents don't think this is a problem.
      • Then I tried your GET|openssl command, it was complaining about not being able to find certs/puppet.local.something and private_keys/puppet.local.something.
      • I symlinked puppet.local (to use gaia.local, the actual certificate). This works. Probably not the nicest way, but it works!

      Exported config now works.

      So it seems to have been something to do with the terminus using the wrong certificate somehow.

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              redmine.exporter redmine.exporter
            • Votes:
              1 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Zendesk Support