三.认证并分发：
(client):
客户端发送请求
# puppetd --test --server server.example.com
报错：
--------------------
err: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0
state=SSLv3 read server certificate B: certificate verify failed
warning: Not using cache on failed catalog
err: Could not retrieve catalog; skipping run
--------------------
解决方法：
这可能是换了不同的两台puppetmaster服务器引起的。解决方法，删除现有ssl证书。
# find /var/lib/puppet -type f -print0 |xargs -0r rm
重新发送请求：
# puppetd --test --server server.example.com
-------------------
info: Creating a new SSL key for client.example.com
warning: peer certificate won't be verified in this SSL session
info: Caching certificate for ca
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
info: Creating a new SSL certificate request for client.example.com
info: Certificate Request fingerprint (md5):
32:E8:CD:32:BF:62:86:64:B3:98:A4:EB:8A:71:D2:99
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
warning: peer certificate won't be verified in this SSL session
Exiting; no certificate found and waitforcert is disabled
-------------------
发送成功。
(server)：
服务器端查看是否有请求证书的客户端服务器
# puppetca --list
------------------
client.example.com (32:E8:CD:32:BF:62:86:64:B3:98:A4:EB:8A:71:D2:99)
------------------
收到客户端认证信息
服务器端对client.example.com签名
# puppetca -s client.example.com
或对所有客户端全部签名
# puppetca -s -a
查看验证签名,注意前面的+号，说明已经签名
# puppetca -a --list
---------------------
+ client.example.com (19:6F:4C:84:B1:69:16:3C:A1:38:C2:2E:6F:B6:67:12)
---------------------
md5验证服务器端收到的证书是否正确
(server)：
# md5sum /var/lib/puppet/ssl/ca/signed/client.example.com.pem
---------------------
1ebfd47775ec8f3e2ae112d75ccba132 /var/lib/puppet/ssl/ca/signed/client.example.com.pem
---------------------
(client)：
# md5sum /var/lib/puppet/ssl/certs/client.example.com.pem
---------------------
1ebfd47775ec8f3e2ae112d75ccba132 /var/lib/puppet/ssl/certs/client.example.com.pem
---------------------
MD5值相同，说明我们的puppetmaster和客户端的puppet已经成功建立通信
注：出现修改主机名问题引起无法认证，需要重新申请证书，操作可以按照如下两个步骤：
(server)：
# rm -rf /var/lib/puppet/ssl/ca/signed/*.pem // "*.pem"为修改过主机名的证书
(client)：
# rm -rf /var/lib/puppet/ssl/
配置完毕，开始验证分发效果：
(server)：
修改server端配置文件：
# vi /etc/puppet/manifests/site.pp
-----------------
node default{
file { "/tmp/test":
content=> "this is a test file";
}
}
-----------------
重启puppetmaster，更新配置文件信息。
# service puppetmaster restart
(client):
重启puppet（可不用重启）
# service puppet restart
同步文件：
# puppetd --server server.example.com --test
------------------
warning: peer certificate won't be verified in this SSL session
info: Caching certificate for client.example.com
info: Caching certificate_revocation_list for ca
info: Caching catalog for client.example.com
info: Applying configuration version '1369124449'
notice: /Stage[main]//Node[default]/File[/tmp/test]/ensure: defined content as '{md5}100b144907af2a4786003758a0a6a563'
info: Creating state file /var/lib/puppet/state/state.yaml
notice: Finished catalog run in 0.02 seconds
------------------
查看/tmp/test文件及文件内容
# cat /tmp/test
-----------
this is a test file
-----------
-----------大功告成-------------
puppet的具体功能模块这里就不做过多阐述