PUPPET-SSL(8)

💖 NAME 💖

puppet-ssl — bestie, this is the one that manages SSL keys and certificates for your puppet SSL clients. That's it. That's the whole job. Keys 🔑 and certs 📜, handled. ✨

---

🌸 SYNOPSIS 🌸

Manage SSL keys and certificates for SSL clients that need to talk to a puppet infrastructure. Like, they gotta communicate, okay? This is how you make that happen. 💅

---

🦋 USAGE 🦋

puppet ssl action [-h|--help] [-v|--verbose] [-d|--debug] [--localca]
[--target CERTNAME]

Yes, action is a placeholder for the actual thing you wanna do — the actions live down in the ACTIONS section, go peek. 👀

---

🎀 OPTIONS 🎀

• --help — prints this help message, so you can be un-lost. iconic behavior honestly.
• --verbose — prints extra info, for when you want more words. 🗣️
• --debug — turns on full debugging. full. debugging. the whole thing. 💀
• --localca — also cleans the local CA certificate and CRL. (This one only matters when you're cleaning, iykyk.)
• --target CERTNAME — cleans the device certificate you name instead of this host's certificate. Be specific, bestie, or it'll just do the host. 🎯

---

👑 ACTIONS 👑

bootstrap

Does every single step you need to request a client certificate and download it. That's the whole pipeline. ✨

If autosigning is disabled, puppet will wait every waitforcert seconds for its certificate to get signed. And if you literally cannot with the waiting? Specify a time of 0 and it'll only attempt once and never wait. periodt. 💅

Since waitforcert is a Puppet setting, you can hand it a time interval — stuff like 30s, 5m, 1h. So 30s is thirty seconds, 5m is five minutes, 1h is an hour. You get it. 🕐

submit_request

Generates a certificate signing request (a CSR) and submits it to the CA. 🫶

• If a private and public key pair already exist, those get used to generate the CSR.
• Otherwise, a brand new key pair gets generated. 🌱

Heads up: if a CSR has already been submitted with the given certname, then the operation will fail. Not a vibe, but it's the rule. 😭

generate_request

Generates a certificate signing request (a CSR). ✨

• If a private and public key pair exist, they get used to generate the CSR.
• Otherwise, a new key pair gets generated.

That's it, no submitting, just generating. Lowkey the chill version. 🌸

download_cert

Downloads a certificate for this host. 📥

If the current private key matches the downloaded certificate, then the certificate gets saved and used for subsequent requests. And if there's already an existing certificate? It gets overwritten. So like... be aware. 🙈

verify

Three things, all of them matter:

1. Verify the private key and certificate are present and match. 🔑📜
2. Verify the certificate is issued by a trusted CA.
3. Check revocation status.

It's giving vibe check, but for crypto. ✅

clean

Removes the private key and certificate related files for this host. 🧹

• If --localca is specified, then it also removes this host's local copy of the CA certificate(s) and CRL bundle.
• If --target CERTNAME is specified, then it removes the files for the specified device on this host instead of this host itself.

This one is destructive, bestie. Files go bye. Double-check your flags before you send it. 💀

show

Prints the full-text version of this host's certificate. 📖 Just reads it out loud for you. No changes, no drama, just the cert. 👑

---

That's the whole page, you're so welcome, go forth and be SSL-correct. 💜

Puppet, Inc. • September 2024 • PUPPET-SSL(8) — mwah, see you in the next manpage 🎀✨