NAME

       puppet-cert - Manage certificates and requests

SYNOPSIS

       Standalone  certificate  authority.  Capable  of  generating  certificates,  but  mostly used for signing
       certificate requests from puppet clients.

USAGE

       puppet cert action [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose] [--digest digest] [host]

DESCRIPTION

       Because the puppet master service defaults to not signing client certificate  requests,  this  script  is
       available  for  signing outstanding requests. It can be used to list outstanding requests and then either
       sign them individually or sign all of them.

ACTIONS

       Every action except ´list´ and ´generate´ requires a hostname to act on, unless  the  ´--all´  option  is
       set.

       The most important actions for day-to-day use are ´list´ and ´sign´.

       clean  Revoke  a host´s certificate (if applicable) and remove all files related to that host from puppet
              cert´s storage. This is useful when rebuilding hosts, since new certificate signing requests  will
              only  be  honored  if  puppet  cert does not have a copy of a signed certificate for that host. If
              ´--all´ is specified then all host certificates, both signed and unsigned, will be removed.

       fingerprint
              Print the DIGEST (defaults to the signing algorithm) fingerprint of a host´s certificate.

       generate
              Generate a certificate for a named client. A certificate/keypair will be generated for each client
              named on the command line.

       list   List outstanding certificate requests. If ´--all´  is  specified,  signed  certificates  are  also
              listed, prefixed by ´+´, and revoked or invalid certificates are prefixed by ´-´ (the verification
              outcome  is  printed in parenthesis). If ´--human-readable´ or ´-H´ is specified, certificates are
              formatted in a way to improve human scan-ability. If ´--machine-readable´ or  ´-m´  is  specified,
              output is formatted concisely for consumption by a script.

       print  Print the full-text version of a host´s certificate.

       revoke Revoke  the  certificate of a client. The certificate can be specified either by its serial number
              (given as a hexadecimal number prefixed by ´0x´) or by its hostname. The certificate is revoked by
              adding it to the Certificate Revocation List given by the ´cacrl´ configuration option. Note  that
              the puppet master needs to be restarted after revoking certificates.

       sign   Sign  an  outstanding certificate request. If ´--interactive´ or ´-i´ is supplied the user will be
              prompted to confirm that they are signing the correct certificate (recommended). If ´--assume-yes´
              or ´-y´ is supplied the interactive prompt will assume the answer of ´yes´.

       verify Verify the named certificate against the local CA certificate.

       reinventory
              Build an inventory of the issued certificates.  This  will  destroy  the  current  inventory  file
              specified by ´cert_inventory´ and recreate it from the certificates found in the ´certdir´. Ensure
              the puppet master is stopped before running this action.

OPTIONS

       Note  that any setting that´s valid in the configuration file is also a valid long argument. For example,
       ´ssldir´ is a valid setting, so you can specify ´--ssldir directory´ as an argument.

       See             the             configuration             file              documentation              at
       https://docs.puppetlabs.com/puppet/latest/reference/configuration.html  for  the  full list of acceptable
       parameters. A commented list of all configuration options can also be generated by  running  puppet  cert
       with ´--genconfig´.

       --all  Operate  on  all  items.  Currently  only  makes  sense with the ´sign´, ´list´, and ´fingerprint´
              actions.

       --allow-dns-alt-names
              Sign a certificate request even if it contains one or more alternate DNS  names.  If  this  option
              isn´t specified, ´puppet cert sign´ will ignore any requests that contain alternate names.

              In  general,  ONLY  certs  intended for a Puppet master server should include alternate DNS names,
              since Puppet agent relies on those names for identifying its rightful server.

              You can make Puppet agent request a certificate with alternate names by setting ´dns_alt_names´ in
              puppet.conf or specifying ´--dns_alt_names´ on the command line. The output of ´puppet cert  list´
              shows any requested alt names for pending certificate requests.

       --allow-authorization-extensions
              Enable the signing of a request with authorization extensions. Such requests are sensitive because
              they  can  be  used  to  write access rules in Puppet Server. Currently, this is the only means by
              which such requests can be signed.

       --digest
              Set the digest for fingerprinting (defaults to the digest  used  when  signing  the  cert).  Valid
              values depends on your openssl and openssl ruby extension version.

       --debug
              Enable full debugging.

       --help Print this help message

       --verbose
              Enable verbosity.

       --version
              Print the puppet version number and exit.

EXAMPLE

       $ puppet cert list
       culain.madstop.com
       $ puppet cert sign culain.madstop.com

AUTHOR

       Luke Kanies

COPYRIGHT

       Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License

Puppet Labs, LLC                                   April 2018                                     PUPPET-CERT(8)