# puppet 3 - OpenSSL not playing nice



## dotemacs (Jan 3, 2013)

Brand new install, FreeBSD 9.1-RELEASE.

/etc/make.conf:

```
RUBY_DEFAULT_VER=1.9
BATCH=yes
# added by use.perl 2013-01-03 21:31:20
PERL_VERSION=5.14.2
```

Installed sysutils/puppet and when I try to do:


```
$ puppet module search apache
```

I get: 

```
Searching https://forge.puppetlabs.com ...
Error: Could not connect via HTTPS to https://forge.puppetlabs.com
  Unable to verify the SSL certificate
    The certificate may not be signed by a valid CA
    The CA bundle included with OpenSSL may not be valid or up to date
Error: Try 'puppet help module search' for usage
```

What do I need to do to make this work?

Thanks


----------



## cpm@ (Jan 4, 2013)

Maybe a misconfiguration in puppet.conf can be your problem related connection.

Please, show output:

`# cat /usr/local/etc/puppet/puppet.conf`

Puppet on FreeBSD http://projects.puppetlabs.com/projects/1/wiki/Puppet_Free_Bsd.


----------



## dotemacs (Jan 5, 2013)

puppet.conf is not in place, this is even before the master has been set up.


----------



## cpm@ (Jan 5, 2013)

Check out http://comments.gmane.org/gmane.comp.sysutils.puppet.scm/2737.


> Previously we had been using 'localhost' as the location of the master, which
> is a dangerous assumption with systest, since the master may be located on
> another host or 'localhost' may not give us the expected results.
> 
> ...


----------



## dotemacs (Jan 5, 2013)

Solved.

*security/ca_root_nss* port needed to be installed with *ETCSYMLINK* turned on.


----------



## cpm@ (Jan 5, 2013)

The port creates the correct link to verify the SSL certificate:

/usr/local/ssl/cert.pem -> /usr/local/share/certs/ca-root-nss.crt

I'm glad you solved it


----------



## dotemacs (Jan 6, 2013)

The link that needed to be created is between /usr/local/share/certs/ca-root-nss.crt and /etc/ssl/cert.pem.

The issue can be resolved automatically by adding the following to /etc/make.conf:


```
.if ${.CURDIR:M*/security/ca_root_nss}
    WITH_ETCSYMLINK=on
    .endif
```


----------

