Regenerating Certs for PuppetDB

A newer version is available; see the version menu above for details.

The major components of Puppet Enterprise (the Puppet master, PuppetDB, and PE console) contain SSL certificates and security credentials (private and public keys) that are generated by PE’s built-in certificate authority (CA). The following document provides instructions on regenerating the cert and security credentials for PuppetDB.

Regenerating certificates and security credentials for PuppetDB involves the following steps:

  1. Back up SSL directories on the PuppetDB server
  2. Shut down all PE-related services on the PuppetDB server
  3. Clear and regenerate the Puppet agent certs for the PuppetDB server
  4. Copy the new certs and security credentials to the appropriate directory and set permissions
  5. Restart all PE-related services on the PuppetDB server

Important: This document applies to the certs and security credentials for the PuppetDB server only. If you’ve experienced an unforeseen security vulnerability and need to regenerate all the certificates and security credentials in your infrastructure, refer to Regenerating Certs and Security Credentials in Split Puppet Enterprise Deployments for complete instructions.

In addition, this guide also applies to split installations only. On monolithic installs, PuppetDB shares an agent cert and security credentials with the Puppet master and the PE console. For a monolithic install, you must regenerate all certs and security credentials.

Clear and Regenerate Certs for PuppetDB

To clear and regenerate certs on your PuppetDB server:


  • You must be logged in as a root, (or in the case of Windows agents, as an account with Administrator Privileges) to make these changes.

  • If you encounter any errors during steps that involve service stop/start, rm, cp, or chmod commands, you should diagnose these before continuing, as the success each step is very important to the success of the next step.

  • In the following instructions, when <CERTNAME> is used, it refers to the Puppet agent’s certname. To find this value, run puppet config print certname before starting.

  • Unless otherwise indicated, all commands are run on the PuppetDB server.

  1. On the PuppetDB, back up the following directories:

    • /etc/puppetlabs/puppet/ssl/

    • /etc/puppetlabs/puppetdb/ssl/

    • /opt/puppetlabs/server/data/postgresql/9.4/data/certs/*

  2. On the PuppetDB, shut down all PE-related services with the following commands:

     puppet resource service puppet ensure=stopped
     puppet resource service pe-puppetdb ensure=stopped
     puppet resource service pe-postgresql ensure=stopped
     puppet resource service mcollective ensure=stopped
  3. On the PuppetDB, delete the Puppet agent’s SSL cert and security credentials.

     rm -rf /etc/puppetlabs/puppet/ssl/*
  4. On the Puppet master, or CA server, remove the cert for the PuppetDB node.

     puppet cert clean <PUPPETDB CERTNAME>
  5. On the Puppet master, remove the cached catalog.

     rm -f /opt/puppetlabs/puppet/cache/client_data/catalog/<CERTNAME>.json
  6. On the PuppetDB, generate security credentials and request a new certificate from the CA Puppet master. These certs will end up in /etc/puppetlabs/puppet/ssl.

     puppet agent --test --no-daemonize --noop

    Note: This agent run will not complete successfully, but it is necessary to set up the agent certificate for the PuppetDB node. You will see some errors about node definition and the inability to submit facts due to PuppetDB being offline. You can ignore these.

  7. On the PuppetDB, delete puppetDB’s SSL cert and security credentials.

     rm -rf /etc/puppetlabs/puppetdb/ssl/*
  8. On the PuppetDB, copy the Puppet agent’s certs and security credentials to the PuppetDB SSL directory.

     cp /etc/puppetlabs/puppet/ssl/certs/<CERTNAME>.pem /etc/puppetlabs/puppetdb/ssl/<CERTNAME>.cert.pem
     cp /etc/puppetlabs/puppet/ssl/public_keys/<CERTNAME>.pem /etc/puppetlabs/puppetdb/ssl/<CERTNAME>.public_key.pem
     cp /etc/puppetlabs/puppet/ssl/private_keys/<CERTNAME>.pem /etc/puppetlabs/puppetdb/ssl/<CERTNAME>.private_key.pem
     chown -R pe-puppetdb:pe-puppetdb /etc/puppetlabs/puppetdb/ssl
  9. On the PuppetDB, clear the certs and security credentials from the PostgreSQL certs directory.

      rm -rf /opt/puppetlabs/server/data/postgresql/9.4/data/certs/*
  10. On the PuppetDB, copy the certs and security credentials to the PostgreSQL certs directory.

    cp /etc/puppetlabs/puppet/ssl/certs/<CERTNAME>.pem /opt/puppetlabs/server/data/postgresql/9.4/data/certs/<CERTNAME>.cert.pem
    cp /etc/puppetlabs/puppet/ssl/public_keys/<CERTNAME>.pem /opt/puppetlabs/server/data/postgresql/9.4/data/certs/<CERTNAME>.public_key.pem
    cp /etc/puppetlabs/puppet/ssl/private_keys/<CERTNAME>.pem /opt/puppetlabs/server/data/postgresql/9.4/data/certs/<CERTNAME>.private_key.pem
    chmod 400 /opt/puppetlabs/server/data/postgresql/9.4/data/certs/*
    chown pe-postgres:pe-postgres /opt/puppetlabs/server/data/postgresql/9.4/data/certs/*
  11. On the PuppetDB, restart all PE-related services with the following commands:

    puppet resource service puppet ensure=running
    puppet resource service pe-puppetdb ensure=running
    puppet resource service pe-postgresql ensure=running
    puppet resource service mcollective ensure=running

↑ Back to top