Ask Your Question
5

How can I troubleshoot problems with Puppet's SSL layer?

asked 2012-11-14 12:42:01 -0500

binford2k gravatar image

updated 2012-12-13 14:55:56 -0500

Dawn gravatar image

When I'm having problems that I suspect may be related to SSL, what are some troubleshooting steps I should take?

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted
11

answered 2012-11-14 19:16:59 -0500

eric0 gravatar image

updated 2013-02-25 13:42:28 -0500

I feel your pain. SSL is tough and is probably the number one stumbling block for new users getting Puppet working in their environment. Hopefully this answer helps reduce frustration and get you up and running. The good news is, once it's set up right, you won't have to fiddle with it any more.

First, make sure the problem you're having is actually an SSL problem. Almost all of the SSL-related error messages on the client start with the string SSL_connect and then the error raised up by the underlying crypto libraries. General networking errors will not ... (more)

edit flag offensive delete link more
4

answered 2012-11-15 15:41:05 -0500

updated 2012-11-15 15:50:54 -0500

Tools

I frequently reach for three tools when debugging SSL issues at the protocol level:

  1. curl
  2. openssl s_client
  3. wireshark

Here's how I use openssl s_client to verify mutual SSL authentication is happening as I expect it to:

Does the server's SSL name match the client's perspective of its hostname?

This question; does the server's SSL name match the client's perspective of it's hostname, is the most important question to ask because this is the most common issue.

If the hostname the agent connects to does not match the name listed in the master's ... (more)

edit flag offensive delete link more

Comments

2

I've often found [Mozilla Certificate Chaining](https://wiki.mozilla.org/ReleaseEngineering/PuppetAgain/Certificate_Chaining) as a helpful resource as well.

stahnma gravatar imagestahnma ( 2012-11-20 16:48:53 -0500 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2012-11-14 12:42:01 -0500

Seen: 2,517 times

Last updated: Feb 25 '13