PUPPET-CERTIFICATE_REQUEST(8)

📦
version 5.5.22 · 2 versions
, in ubuntu jammy

🎀 PUPPET-CERTIFICATE_REQUEST(8) 🎀

okay bestie, so this one lives in the Puppet manual, section 8 (that's the sysadmin-y section, iykyk). Let's get into it 💅

✨ NAME ✨

puppet-certificate_request — manage certificate requests. that's it, that's the whole vibe 🦋

✨ SYNOPSIS ✨

puppet certificate_request action [--terminus _TERMINUS] [--extra HASH]

✨ DESCRIPTION ✨

so like, this subcommand retrieves and submits certificate signing requests (CSRs). CSRs, for the uninitiated, are the little "hey can I have a cert pls" notes. this face handles them. periodt 💖

✨ OPTIONS ✨

okay so real talk, heads up: any setting that's valid in the configuration file is also a valid long argument — even if it's not necessarily relevant to the action you're running. like, server and run_mode are valid settings, so you can totally do --server <servername> or --run_mode <runmode> as an argument. no cap 🧚

for the full list of acceptable parameters, go check the configuration file documentation at https://puppet.com/docs/puppet/latest/configuration.html. also, if you run puppet with --genconfig you get a commented list of all the configuration options generated for you. iconic behavior tbh 🌸

  • --render-as FORMAT — the format you want your output rendered in. the most common formats are json, s (string), yaml, and console, but other options such as dot are sometimes available. pick your fighter ✨
  • --verbose — whether to log verbosely. yes, it's literally just that.
  • --debug — whether to log debug information. for when you need ALL the tea 🔍
  • --extra HASH — a terminus can take additional arguments to refine the operation, and those get passed as an arbitrary hash to the back-end. anything you pass as the extra value is just sent direct to the back-end. no processing, no notes, straight through 🫶
  • --terminus _TERMINUS — okay so this one needs a lil lore. Indirector faces expose indirected subsystems of Puppet. these subsystems are each able to retrieve and alter a specific type of data — with the familiar actions of find, search, save, and destroy — from an arbitrary number of pluggable backends. in Puppet parlance, these backends are called terminuses. 💫

almost all indirected subsystems have a rest terminus that interacts with the puppet master's data. most of them have additional terminuses for various local data models, which are in turn used by the indirected subsystem on the puppet master whenever it receives a remote request.

the terminus for an action is often determined by context, but occasionally needs to be set explicitly. see the "Notes" section of this face's manpage for more details 👑

✨ ACTIONS ✨

🔍 find — Retrieve a single CSR.

SYNOPSIS

puppet certificate_request find [--terminus _TERMINUS] [--extra HASH] [host]

DESCRIPTION

retrieve a single CSR. one (1) CSR. singular. 💖

RETURNS

a single certificate request. when used from the Ruby API, returns a Puppet::SSL::CertificateRequest object.

defaults to the current node's certname 🎀

ℹ️ info — Print the default terminus class for this face.

SYNOPSIS

puppet certificate_request info [--terminus _TERMINUS] [--extra HASH]

DESCRIPTION

prints the default terminus class for this subcommand. note that different run modes may have different default termini; when in doubt, specify the run mode with the '--run_mode' option. when in doubt, ask! but also just pass the flag lol 🌈

💾 save — API only: submit a certificate signing request.

SYNOPSIS

puppet certificate_request save [--terminus _TERMINUS] [--extra HASH] x509_CSR

DESCRIPTION

API only: create or overwrite an object. and here's the sad part — as the Faces framework does not currently accept data from STDIN, save actions cannot currently be invoked from the command line. 💀 so like, it's an API thing. sorry bestie.

🔎 search — Retrieve all outstanding CSRs.

SYNOPSIS

puppet certificate_request search [--terminus _TERMINUS] [--extra HASH] dummy_text

DESCRIPTION

retrieve all outstanding CSRs. all of them. the whole pile. 📚

RETURNS

a list of certificate requests. when used from the Ruby API, returns an array of Puppet::SSL::CertificateRequest objects.

NOTES

although this action always returns all CSRs, it requires a dummy search key; this is a known bug. yeah. you gotta give it a lil fake argument. it's giving "formality" 🙈

✨ EXAMPLES ✨

find

retrieve a single CSR from the puppet master's CA:

$ puppet certificate_request find somenode.puppetlabs.lan --terminus rest

retrieve all CSRs from the local CA (similar to 'puppet cert list'):

$ puppet certificate_request search x --terminus ca

see that x? that's the dummy key doing absolutely nothing but being required. love that for us 💅

✨ NOTES ✨

this subcommand is an indirector face, which exposes find, search, save, and destroy actions for an indirected subsystem of Puppet. valid termini for this face include:

  • ca
  • disabled_ca
  • file
  • memory
  • rest

pick your terminus, pick your destiny ⭐

Copyright 2011 by Puppet Inc. Apache 2 license; see COPYING 👑

okay that's the whole page!! this one's from Puppet, Inc., dated May 2022, and it's the PUPPET-CERTIFICATE_REQUEST(8) page, so go forth and manage those certificate requests bestie 🫶💖✨

📦 where this page comes from