Conenction or version problem?

[voxpupuli]

Conenction or version problem?

[corey-hammerton]

This log entry indicates that it could not connect to the configured PuppetDB server:

ERROR:pypuppetdb.api:Could not reach PuppetDB on puppet-test01.smaatolabs.net:8081 over HTTPS.

Either because it cannot resolve the name, the port isn't open or HTTPS is not properly configured.

The issue is connection related, not software.

[daenney]

It's most likely a certificate configuration issue.

If PuppetDB and Puppetboard are on the same machine don't use the HTTPS/SSL setup, use plain connection on port 8080.

Otherwise, make sure SSL_KEY and SSL_CERT are readable by the user that is running Puppetboard (apache perhaps) and make sure the full path can be read. Just because a file is 0644 doesn't mean you can actually access the file starting from /.

Also, set SSL_VERIFY to a path that contains the Puppet CA pem file, located by default in /var/lib/puppet/ssl/certs/ca.pem.

[aruetten]

It's not a connection problem. I checked that via telnet:

# telnet puppet-test01.smaatolabs.net 8081
Trying 10.128.18.5...
Connected to ec2-54-XXX-96-84.compute-1.amazonaws.com.
Escape character is '^]'.
^]
telnet> quit
Connection closed.

Also the certificate stuff should be right. A SSL handshake is possible:

# openssl s_client -key /var/lib/puppet/ssl/private_keys/puppetboard-test01.ec2.internal.pem -cert /var/lib/puppet/ssl/certs/puppetboard-test01.ec2.internal.pem -CAfile /var/lib/puppet/ssl/certs/ca.pem -connect puppet-test01.smaatolabs.net:8081
CONNECTED(00000003)
depth=1 CN = Puppet CA: puppet-test01.smaatolabs.net
verify return:1
depth=0 CN = puppet-test01.smaatolabs.net
verify return:1
---
Certificate chain
 0 s:/CN=puppet-test01.smaatolabs.net
   i:/CN=Puppet CA: puppet-test01.smaatolabs.net
---
Server certificate
-----BEGIN CERTIFICATE-----
XXX
-----END CERTIFICATE-----
subject=/CN=puppet-test01.smaatolabs.net
issuer=/CN=Puppet CA: puppet-test01.smaatolabs.net
---
Acceptable client certificate CA names
/CN=Puppet CA: puppet-test01.smaatolabs.net
---
SSL handshake has read 1733 bytes and written 4236 bytes
---
XXX
---
asdfs
HTTP/1.1 400 Bad Request
Content-Length: 0
Connection: close
Server: Jetty(7.x.y-SNAPSHOT)

I will now check the file permissions

[aruetten]

There was a permission problem. I changed that so the the openssl connect command was also possible as user www-data.
Unfortunately I get still the same error in the log.

[daenney]

Did you set SSL_VERIFY to the ca.pem file?

[aruetten]

That has fixed it, thanks