puppet-ssl - Manage SSL keys and certificates for puppet
SSL clients
Manage SSL keys and certificates for SSL clients needing to
communicate with a puppet infrastructure.
puppet ssl action [-h|--help] [-v|--verbose] [-d|--debug]
[--localca] [--target CERTNAME]
- --help: Print this help message.
- --verbose: Print extra information.
- --debug: Enable full debugging.
- --localca Also clean the local CA certificate and CRL.
- --target CERTNAME Clean the specified device certificate instead of this
host´s certificate.
-
- bootstrap
- Perform all of the steps necessary to request and download a client
certificate. If autosigning is disabled, then puppet will wait every
waitforcert seconds for its certificate to be signed. To only
attempt once and never wait, specify a time of 0. Since waitforcert
is a Puppet setting, it can be specified as a time interval, such as 30s,
5m, 1h.
- submit_request
- Generate a certificate signing request (CSR) and submit it to the CA. If a
private and public key pair already exist, they will be used to generate
the CSR. Otherwise a new key pair will be generated. If a CSR has already
been submitted with the given certname, then the operation will
fail.
- generate_request
- Generate a certificate signing request (CSR). If a private and public key
pair already exist, they will be used to generate the CSR. Otherwise a new
key pair will be generated.
- download_cert
- Download a certificate for this host. If the current private key matches
the downloaded certificate, then the certificate will be saved and used
for subsequent requests. If there is already an existing certificate, it
will be overwritten.
- verify
- Verify the private key and certificate are present and match, verify the
certificate is issued by a trusted CA, and check revocation status.
- clean
- Remove the private key and certificate related files for this host. If
--localca is specified, then also remove this host´s local
copy of the CA certificate(s) and CRL bundle. if --target CERTNAME
is specified, then remove the files for the specified device on this host
instead of this host.
- show
- Print the full-text version of this host´s certificate.