我的puppet.conf在主人身上
[master] certname = myname.mydomain.com ca_server = myname.mydomain.com certdnsnames = puppet;puppet.local;myname.dyndns.org;hivemind.local;
对于我对定义的certdnsnames的理解,以下应该有效：
puppet agent --server myname.dyndns.org --test
但我收到以下错误：
err: Could not retrieve catalog from remote server: hostname was not match with the server certificate
如何避免这个错误？如何正确定义certdnsnames？我找到了关于此的不同文档,但没有简单的例子.我使用“,”分开,我根本无法签名.
我也看过像这样的语法
certdnsnames = puppet:puppet.intra.myserver.fr,puppet.myserver.fr:puppet,puppet:puppet,puppet.intra.myserver.fr,puppet.myserver.fr
http://projects.puppetlabs.com/issues/5776
但对于我来说,还不清楚何时添加“傀儡：”而不是.
解决方法
为了任何偶然发现这个答案的人的利益：
由于CVE-2011-3872,Puppet不再支持certdnsnames选项.从文档：
The certdnsnames setting is no longer functional,after CVE-2011-3872.
We ignore the value completely. For your own certificate request you
can set dns_alt_names in the configuration and it will apply locally.
There is no configuration option to set DNS alt names,or any other
subjectAltName value,for another nodes certificate. Alternately you
can use the –dns_alt_names command line option to set the labels
added while generating your own CSR.
您可以使用subjectAlternativeName为您的服务器生成SSL证书,如下所示：
$puppet cert generate <puppet master's certname> --dns_alt_names=<comma-separated list of DNS names>
