Regenerate the console certificate
The console certificate expires every 824 days. Regenerate the console certificate when it is nearing or past expiration, or if the certificate is corrupted and you're unable to access the console.
/opt/puppetlabs/puppet/bin/openssl x509 -in /etc/puppetlabs/puppet/ssl/certs/console-cert.pem -noout -startdate -enddate
To generate a new console certificate, remove the existing certificate. After you remove the existing certificate, a new one is generated automatically on the next Puppet run.
Remove the existing console certificate.
On your primary server, run both these commands:
puppet ssl clean --certname console-cert puppetserver ca clean --certname console-cert
Run Puppet to generate a new certificate.
On the primary server, run:
Alternatively, you can wait for the next Puppet run.
puppet agent -t