# Puppet Certificate verification failed

Mismatch between agent and master certificates or expired certificates.

## What is Puppet Certificate verification failed

## Understanding Puppet and Its Purpose

Puppet is a powerful open-source configuration management tool used to automate the provisioning, configuration, and management of servers and other infrastructure. It allows system administrators to define the desired state of their systems using a declarative language, ensuring consistency and reducing manual errors. Puppet operates in a client-server architecture, where the Puppet master manages the configurations and the Puppet agents apply these configurations to the nodes.

## Identifying the Symptom: Certificate Verification Failed

One common issue encountered by Puppet users is the 'Certificate verification failed' error. This error typically occurs when there is a problem with the SSL certificates used for secure communication between the Puppet master and its agents. The error message might look something like this:

Error: Could not request certificate: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed

## Exploring the Issue: Why Certificate Verification Fails

The 'Certificate verification failed' error generally arises due to a mismatch between the certificates on the Puppet master and the agent, or because the certificates have expired. This can happen if the agent's certificate does not match the master's certificate or if the certificate authority (CA) used to sign the certificates is incorrect or outdated.

### Common Causes

- Agent and master certificates do not match.
- Certificates have expired.
- Incorrect CA used for signing certificates.

## Steps to Fix the Certificate Verification Issue

To resolve the 'Certificate verification failed' issue, follow these steps:

### Step 1: Clean Up Existing Certificates

On the Puppet agent, clean up the existing certificates:

```bash
puppet agent --configprint ssldir
```

Navigate to the SSL directory and remove the old certificates:

```bash
rm -rf /var/lib/puppet/ssl/*
```

### Step 2: Regenerate Certificates on the Agent

Request a new certificate from the Puppet master:

```bash
puppet agent --test --waitforcert=60
```

This command will generate a new certificate signing request (CSR) and send it to the Puppet master.

### Step 3: Sign the Certificate on the Master

On the Puppet master, list the pending certificate requests:

```bash
puppet cert list
```

Sign the agent's certificate request:

```bash
puppet cert sign <agent_hostname>
```

### Step 4: Verify the Configuration

After signing the certificate, run the Puppet agent again to verify that the issue is resolved:

```bash
puppet agent --test
```

## Additional Resources

For more information on managing Puppet certificates, refer to the official Puppet documentation. If you encounter further issues, consider visiting the Puppet Community for support and guidance.