Home / server / Questions / 202887
Accepted
Tom
Asked: 2010-11-18 03:44:12 +0800 CST

migrating puppet clients to a new puppet master (old puppet master server gone, only using backup)

  • 772

My puppet master server had a hardware failure, and I have restored to another box. However this box has different hardware and hostname.

If I restore the existing /etc/puppet directory to the new server, the puppetmaster will not start with the following error;

# puppetmasterd --debug --verbose Could not prepare for execution: Retrieved certificate does not match private key; please remove certificate from server and regenerate it with the current key

So what steps do I need to take to allow the new puppetmaster to start, and to generate a new puppetmaster certificate using the old ca..

Also will the puppet clients actually report in to a different puppet server using a server certificate that has been generated with the old CA?

puppet

1 Answers

  1. Best Answer

    The puppetmaster stores all of the certificates, keys, and ca information in the folder /var/lib/puppet/ssl. From my testing you should be able to:

    1. stop puppetmasterd
    2. delete the file /var/lib/puppet/ssl/certs/hostname.pem
    3. start puppetmasterd

    This should generate a new server side ssl certificate using the old private key and CA, as well as preserve the existing client certificates that have already been signed.

    • 5