Puppet Error in generating new certificates when a new puppet master is created

Question

After creating a new Puppet Master to upgrade to Puppet6, I executed the following inorder to clear old certificates.

rm -rf /etc/puppetlabs/puppet/ssl

After pointing the old client at the new master, the client cannot generate new certificates.

Here's the Error that i am getting:

Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN={server FQDN}]
Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet:///pluginfacts: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN={server FQDN}]

Answer 1

A new certificate has to be generated on the client end so that it can be signed by the new puppetmaster, hence the existing certificates have to be deleted on the client side:

rm -rf /var/lib/puppet/ssl

On the server-side

puppetserver ca clean --certname <hostname_of_client>
rm -rf /opt/puppetlabs/puppet/ssl

Try deleting the ssl folder on the puppet client and try again:

 puppet agent --waitforcert 60 --test