puppet-enterprise-3.1.0-el-6-i386 client/agent test fails

Question

I installed PE Master on one VM and Agents on two VMs pointing to master . Agent1 VM 64 bit works fine , but agent2 VM 32 bit fails with below error. Only difference is architecture. One more note both the agent nodes were accepted from Dashboard,so master has both the certificates.

Any help will be greatly appreciated.

puppet-enterprise-3.1.0-el-6-i386]# puppet agent --test

Info: Caching certificate for Info: Caching certificate_revocation_list for ca Warning: Unable to fetch my node definition, but the agent run will continue:

Warning: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify

failed: [CRL is not yet valid for /CN=hostname

Info: Retrieving plugin Error: /File[/var/opt/lib/pe-puppet/lib]: Failed to generate additional resources using

'eval_generate': SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [CRL is not yet valid for /CN=]

Error: /File[/var/opt/lib/pe-puppet/lib]: Could not evaluate: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [CRL is not yet valid for /CN=] Could not retrieve file metadata for puppet:///plugins: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [CRL is not yet valid for /CN=]

Error: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [CRL is not yet valid for /CN=]

Warning: Not using cache on failed catalog

Error: Could not retrieve catalog; skipping run

Error: Could not send report: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed: [CRL is not yet valid for /CN=v]

Thank you

Answer 1

That error message usually indicates that time is not in sync between all of the machines. Running ntpdate or using the ntpd service should bring time into sync and alleviate the problem. Here's an example of another puppet user seeing this problem:

http://www.puppetlogs.com/puppet/%23puppet-2013-02-26.log.html (search for "CRL is not yet valid for /CN=")