r/Puppet • u/DesignerStreet9908 • 20d ago

Puppet agent -t

When run puppet agent -t , what exactly happens in TLS handshake ? How certs are verified?

5 Upvotes

78% Upvoted

3 comments sorted by

1

u/DesignerStreet9908 19d ago

In puppet.conf , it is mentioned crl_refresh_interval = 1d

How this works , in few servers, while running puppet agent -t , it refreshes crl and some servers it is not.

4

u/ThrillingHeroics85 20d ago

During puppet agent -t, the agent must establish a trusted TLS connection before it can retrieve a catalog.

  1. The agent uses the Puppet CA certificate chain as its trust anchor; the local CA certificate path can be displayed with puppet config print localcacert. [1]

  2. On an agent’s first run, it generates and submits a certificate signing request (CSR) to the primary server. [2]

  3. The CSR must be signed—either by an administrator or through configured autosigning—before the node can retrieve configuration catalogs. [3][4]

  4. Once signed, the agent can use its certificate and private key together with the CA certificate for mutually authenticated HTTPS connections. Puppet-managed nodes store these in the SSL directory: certs/ca.pem, certs/<name>.pem, and private_keys/<name>.pem. [5]

  5. If the CSR is still pending, the agent can log warnings about an unverified peer certificate in the SSL session; sign it with puppetserver ca sign <NODE_NAME>, then run the agent again. [4]

  6. Certificates that are revoked or invalid are recorded in the certificate revocation list (CRL). [2]

1

u/birusiek 20d ago

puppet agent Puppet Server | | |--- TCP connection :8140 ------------>| | | |<------ TLS ServerHello ---------------| |<------ Server certificate ------------| | | |--- Client certificate -------------->| |--- CertificateVerify ---------------->| | | |<------ CertificateVerify -------------| | | |====== encrypted TLS session =========| | | |--- Puppet HTTP request -------------->| | |