CRL is not yet valid for /CN=Puppet CA

puppet-enterprise-3.1.0-el-6-i386]# puppet ... Caching certificate_revocation_list for ca Warning... failed: [CRL is not yet valid for /CN=]...

(crl) subject.call(false, ssl_context) expect(subject.verify_errors).to eq(["CRL is not yet valid for /CN=Puppet CA: puppetmaster.example.com"])...

CertificateRequest foobar at '/var/lib/puppet/ssl/ca/requests/foobar.pem' ... B: certificate verify failed: [CRL is not yet valid for /CN=XXX] ...

Puppet is much loved for it’s clear meaningful messages when something ... certificate verify failed: [CRL is not yet valid for /CN=host.example....

Server side : puppetca —list —all blabla.domain.com (CRL is not yet valid) (Few time later) Server side : puppetca —list —all blabla....

CN=Puppet CA: master.example.com Validity Not Before: Apr 2 20:01:28... CRL Sign X509v3 Subject Key Identifier: 8C:2F:14:84:B6:A1:B5:0C:...

CA MUST provide the authorityKeyIdentifier extension in the CRL to identify ... Issuer: CN=Puppet CA: debian7-master.localdomain Validity Not Before:...

If a certificate request is not autosigned, it... certificate revocation list (CRL) for the CA. ...s SSL DN (e.g., /CN=puppet.puppetlabs.com)...

0.1 x509: certificate is valid for , not ... [v3_ca] subjectAltName = IP:127.0.0.1 ... openssl req -subj '/CN=subdomain.domain.com/...

server.pem: /C=AU/ST=Queensland/O=CryptSoft Pty Ltd/CN=Test CA (... 11 X509_V_ERR_CRL_NOT_YET_VALID: CRL is not yet valid the CRL is...