migrating puppet clients to a new puppet master (old puppet master server gone, only using backup)

My puppet master server had a hardware failure, and I have restored to another box. However this box has different hardware and hostname.

If I restore the existing /etc/puppet directory to the new server, the puppetmaster will not start with the following error;

# puppetmasterd --debug --verbose Could not prepare for execution: Retrieved certificate does not match private key; please remove certificate from server and regenerate it with the current key

So what steps do I need to take to allow the new puppetmaster to start, and to generate a new puppetmaster certificate using the old ca..

Also will the puppet clients actually report in to a different puppet server using a server certificate that has been generated with the old CA?

Solution 1:

The puppetmaster stores all of the certificates, keys, and ca information in the folder /var/lib/puppet/ssl. From my testing you should be able to:

1. stop puppetmasterd
2. delete the file /var/lib/puppet/ssl/certs/hostname.pem
3. start puppetmasterd

This should generate a new server side ssl certificate using the old private key and CA, as well as preserve the existing client certificates that have already been signed.