title: Opensource Puppet Master Setup Issue causing unable to get local issuer certificate for /CN=puppet
body: <p>I have to give up using PE to set up my puppet master :( and I have been throw in the cold cruel Opensource Puppet world.
  I have been trying to set up a opensource puppet master on a RHEL7 system.  I am planning to do this a couple of times so wrote a very simple shell script. Here's the script:</p>
  
  <pre><code>#!/bin/sh
  
  pc_rpm_name='puppetlabs-release-pc1'
  pc_yum_repo_url="https://yum.puppetlabs.com/${pc_rpm_name}-el-7.noarch.rpm"
  
  # set up puppet collection yum repo
  rpm -Uvh $pc_yum_repo_url
  yum -y install puppetserver
  systemctl start puppetserver
  /opt/puppetlabs/bin/puppet module install puppetlabs-puppetdb --version 5.1.2
  </code></pre>
  
  <p>I have a puppet master puppet class I wrote it is very simple:</p>
  
  <pre><code>class my_puppetmaster {
      class { 'puppetdb': listen_address =&gt; %{::fqdn} }" 
      include puppetdb::master::config
  }
  </code></pre>
  
  <p>I want to use hiera for my node classification so I have done this:</p>
  
  <pre><code># pwd
  /etc/puppetlabs/code/environments/production/manifests
  # cat site.pp 
  hiera_include('classes')
  </code></pre>
  
  <p>I have also created this file:</p>
  
  <pre><code># pwd
  /etc/puppetlabs/code/environments/production/hieradata/nodes
  # cat puppet_master.yaml 
  classes:
    - my_puppetmaster    
  </code></pre>
  
  <p>And here is my hiera.yaml file:</p>
  
  <pre><code># pwd
  /etc/puppetlabs/puppet
  # head hiera.yaml
  ---
  :backends:
    - yaml
  :hierarchy:
    - "nodes/%{::trusted.certname}"
    - "nodes/%{::role}"
  ...
  </code></pre>
  
  <p>I haven't gotten around to set up a custom fact yet.  I figure I could testing out at the point by rebooting the system to give everything a good shake out and then running <code>puppet agent -t</code> and see what happens.  When I run <code>puppet agent -t</code> on the puppet master I get this output:</p>
  
  <pre><code>Warning: Unable to fetch my node definition, but the agent run will continue:
  Warning: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=puppet]
  Info: Retrieving pluginfacts
  Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=puppet]
  Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet:///pluginfacts: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=puppet]
  Info: Retrieving plugin
  Error: /File[/opt/puppetlabs/puppet/cache/lib]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=puppet]
  Error: /File[/opt/puppetlabs/puppet/cache/lib]: Could not evaluate: Could not retrieve file metadata for puppet:///plugins: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=puppet]
  Error: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=puppet]
  Warning: Not using cache on failed catalog
  Error: Could not retrieve catalog; skipping run
  Error: Could not send report: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=puppet]
  </code></pre>
  
  <p>I guess I left something out of my set up script.  So ... what did I miss?  </p>
  
  <p>Thanks
  Red</p>