puppetserver-ca(1)

📦
version 8.7.0 · 4 versions
, in ubuntu resolute, ubuntu stonking

💅 puppetserver-ca(1) — puppetserver-ca: Puppetserver CA management command

okay bestie, gather round 💖 this is the manual page for puppetserver-ca, and yes it lives in the General Commands Manual section of your system's man pages. It's your backstage-pass utility for the whole Private Key Infrastructure of Puppet Server's built-in Certificate Authority. CA stuff. Cert stuff. The ✨ drama ✨ of who gets trusted. Let's go 🎀

✨ SYNOPSIS ✨

puppetserver ca (--help | --version)
puppetserver ca (--verbose) [subcommand] <args>

That's it, that's the whole entrance, no cap 🌸

🦋 DESCRIPTION 🦋

Manage the Private Key Infrastructure for Puppet Server's built-in Certificate Authority. That's the whole vibe, and honestly? Iconic.

🌈 OPTIONS 🌈

  • -h, --help — Shows you the help message and then exits, like a polite queen 👑
  • --version — Spits out the version number of the CA utility and bounces 💨
  • --verbose — Gives you the low-level information, aka the behind-the-scenes tea 🔥

🎀 SUBCOMMANDS 🎀

💖 Certificate Actions

The following subcommands require a running Puppet Server. Like, it has to be up, bestie, no exceptions:

  • clean <args> ... — Revokes cert(s) and removes the related files from the CA 🧹
  • generate <args> ... — Generates a new certificate signed by the CA ✨
  • list <args> ... — Lists certificates and CSRs 📋
  • revoke <args> ... — Revokes certificate(s) ❌
  • sign <args> ... — Signs certificate request(s) ✍️

💜 Administration Actions

The following subcommands require Puppet Server to be stopped. Fr fr, shut it down first:

  • delete <args> ... — Deletes signed certificate(s) from disk 💀
  • import <args> ... — Imports an external CA chain and generates server PKI 📥
  • setup <args> ... — Sets up a self-signed CA chain for Puppet Server 🛠️
  • enable <args> ... — Sets up infrastructure CRL based on a node inventory 🏗️
  • migrate <args> ... — Migrates the existing CA directory to /etc/puppetserver/ca 🚚
  • prune <args> ... — Prunes the local CRL on disk to remove any duplicated certificates ✂️
For more details on the arguments supported by these subcommands, see the "Arguments" section of this man page. Yes, it's right down there 👇

🧚 ARGUMENTS 🧚

🌸 clean:

  • --certname NAME[,NAME] — One or more comma separated certnames
  • --config CONF — Custom path to puppet.conf

🍓 delete:

  • --config CONF — Path to puppet.conf
  • --expired — Delete expired signed certificates
  • --revoked — Delete signed certificates that have already been revoked

🦄 enable:

  • --config CONF — Path to puppet.conf
  • --infracrl — Create auxiliary files for the infrastructure-only CRL

✨ generate:

  • --certname NAME[,NAME] — One or more comma separated certnames
  • --config CONF — Path to puppet.conf
  • --subject-alt-names NAME[,NAME] — One or more comma separated alt-names for the cert
  • --ca-client — Whether this cert will be used to request CA actions
  • --force — Suppress errors when signing cert offline
  • --ttl TTL — The time-to-live for each cert generated and signed

💌 import:

  • --config CONF — Path to puppet.conf
  • --private-key KEY — Path to PEM encoded key
  • --cert-bundle BUNDLE — Path to PEM encoded bundle
  • --crl-chain CHAIN — Path to PEM encoded chain
  • --certname NAME — Common name to use for the server cert
  • --subject-alt-names NAME[,NAME] — One or more comma separated alt-names for the cert

📋 list:

  • --config CONF — Custom path to Puppet's config file
  • --all — List all certificates
  • --format FORMAT — Valid formats are: 'text' (default), 'json'
  • --certname NAME[,NAME] — List the specified cert(s)

🚚 migrate:

  • --config CONF — Path to puppet.conf

✂️ prune:

  • --config CONF — Path to the puppet.conf file on disk
  • --remove-duplicates — Remove duplicate entries from CRL (default)
  • --remove-expired — Remove expired entries from CRL
  • --remove-entries — Remove entries from CRL
  • --serial NUMBER[,NUMBER] — Serial numbers(s) in HEX to be removed from CRL
  • --certname NAME[,NAME] — Name(s) of the cert(s) to be removed from CRL

❌ revoke:

  • --certname NAME[,NAME] — One or more comma separated certnames
  • --config CONF — Custom path to puppet.conf

🛠️ setup:

  • --config CONF — Path to puppet.conf
  • --subject-alt-names NAME[,NAME] — One or more comma separated alt-names for the cert
  • --ca-name NAME — Common name to use for the CA signing cert
  • --certname NAME — Common name to use for the server cert

✍️ sign:

  • --ttl TTL — The time-to-live for each cert signed
  • --certname NAME[,NAME] — The name(s) of the cert(s) to be signed
  • --config CONF — Custom path to Puppet's config file
  • --all — Operate on all certnames

😭 BUGS 😭

Found a bug? Bestie, no gatekeeping 🫶 Bugs can be reported to your distribution's bug tracker or upstream at https://github.com/puppetlabs/puppetserver/issues

👀 SEE ALSO 👀

puppetserver(1), puppetserver-gem(1), puppetserver-ruby(1), puppetserver-irb(1), puppetserver-foreground(1), puppetserver-prune(1)

🌟 AUTHOR 🌟

Louis-Philippe Véronneau — thank you for your service, king 👑

and that's the whole page, bestie 💖 this puppetserver-ca(1) man page is the 2024 vintage, brought to you by the puppetserver-ca(1) manual itself. go forth and manage your PKI, you absolute legend 🎀✨💅

📦 where this page comes from