New PE install; agent fails "Error: Could not request certificate:"
Hello,
The master is CentOS. The agent is Windows 8.1. On the master, # puppet agent --test --noop produces "normal" results (final line is "Info: Applying configuration version '###'").
On the Windows 8.1 agent, however, I'm met with:
puppet agent --test --noop Error: Could not request certificate: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. - connect(2) for "puppet.xxxxxx.xxxxxxx.com" port 8140 Exiting; failed to retrieve certificate and waitforcert is disabled
The version of the agent on the Windows machine is the same as on the CentOS machine (i.e., 4.2.2).
Can you suggest possible ways to solve this problem or suggest a way to further troubleshoot it?
Thanks in advance.
In response to GregLarkin and masterdam's suggestions, Thank you. The problem is still not resolved though. The agent does not have Telnet installed, but I was able to RemoteDeskTop to the master from the agent. Firewall rules were pretty open on the agent, but I added explicit rules for port 8140 anyway. On the master, iptables is new to me, but I found some info online and added Chain INPUT and OUTPUT rules ACCEPT tcp -- anywhere anywhere tcp dpt:8140
So, either I'm not setting up the firewall rules correctly or I need to explore other possible solutions. BTW. Prior to my install of PE, I did have the agent working with the Open Source version of Puppet. Well, I never really used it beyond testing its connection with a Fedora master. I uninstalled the Open Source agent prior to the PE install.
If it's OK in your environment, try running "service iptables stop" on your Puppet master to turn off the firewall altogether. Does that fix the problem? If not, go ahead and start it back up with "service iptables start".
Here's what I (as root) get: % service iptables stop Redirecting to /bin/systemctl stop iptables.service Failed to issue method call: Unit iptables.service not loaded % systemctl | grep -i iptable % systemctl list-unit-files | grep -i iptable It looks like systemctl does not know about iptable
Ok, didn't realize you were running on CentOS 7. Try "systemctl stop firewalld" and "systemctl start firewalld" instead.
After "stop firewalld" on the master, the agent's 'puppet agent --test --noop' looks much more positive (I.e., Info: Caching certificate for ca, etc...). I shouldn't be flying with me shields down though.
Ok, so you'll need to open port 8140 on the Puppet master to allow incoming connections from Puppet agents.