Jira (PUP-2103) Puppet client does not update and does consult the crl during authentication

[JIRA]

Title: Message Title

Erik Dalén commented on an issue   Re: Puppet client does not update and does consult the crl during authentication I agree that this should get fixed. On the other hand it should only download the updated CRL when it is actually updated, not every time puppet runs. And I believe the indirector is lacking the bits necessary to actually do this. So it requires some patching of that. Meanwhile, I've worked around this problem by exposing the CRL (and some other CA files) directly though apache so they actually get proper HTTP caching headers. It is done by activating mod rewrite and adding this to the virtualhost definition: <IfModule mod_rewrite.c> <Directory /var/lib/puppet/ssl/ca> AllowOverride None Allow from all </Directory> RewriteEngine on RewriteCond %{THE_REQUEST} ^GET RewriteRule ^/\w+/certificate_revocation_list/ca$ /var/lib/puppet/ssl/ca/ca_crl.pem [L,T=text/plain] RewriteCond %{THE_REQUEST} ^GET RewriteRule ^/\w+/certificate/ca$ /var/lib/puppet/ssl/ca/ca_crt.pem [L,T=text/plain] RewriteCond %{THE_REQUEST} ^GET RewriteRule ^/\w+/certificate/([A-Za-z\d\.-]+)$ /var/lib/puppet/ssl/ca/signed/$1.pem [L,T=text/plain] RewriteCond %{THE_REQUEST} ^GET RewriteRule ^/\w+/certificate_request/([A-Za-z\d\.-]+)$ /var/lib/puppet/ssl/ca/requests/$1.pem [L,T=text/plain] </IfModule> Then you also need to upgrade to 3.5 to get new default permissions for CA files so the public ones are publicly readable by Apache. Or stick these lines into puppet.conf: cadir = $ssldir/ca { mode = 775 } cacert = $cadir/ca_crt.pem { mode = 664 } csrdir = $cadir/requests { mode = 775 } signeddir = $cadir/signed { mode = 775 } Then third step is to either have a cron job or a prerun_command that does this to download the crl: curl -s -m 10 --cacert /var/lib/puppet/ssl/certs/ca.pem -z /var/lib/puppet/ssl/crl.pem -o /var/lib/puppet/ssl/crl.pem https://puppet.example.com:8140/production/certificate_revocation_list/ca Hope that helps fixing it for you. Add Comment   Puppet / PUP-2103 Puppet client does not update and does consult the crl during authentication I my tests puppet client never updates it’s /var/lib/puppet/ssl/crl.pem from the master when it changes. Though the CRL is initially downloaded from a CA and ‘cached’ that cache is never cleared causing multi-master setups to run with an increasingly outdated CRL. I think this bug is dangerous especially because the separate CA thing is new and peop... This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.