1PUPPETCA(8)                                                        PUPPETCA(8)
2
3
4
5Stand-alone  certificate  authority.  Capable  of  generating certificates but
6mostly meant for signing certificate requests from puppet clients.puppet  cert
7[-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
8
9
10
11                     [-g|--generate] [-l|--list] [-s|--sign] [-r|--revoke]
12                     [-p|--print] [-c|--clean] [--verify] [--digest DIGEST]
13                     [--fingerprint] [host]
14
15
16       Because  the  puppetmasterd  daemon defaults to not signing client cer‐
17       tificate requests, this script is  available  for  signing  outstanding
18       requests.  It  can be used to list outstanding requests and then either
19       sign them individually or sign all of them.Note that any  configuration
20       parameter  that´s  valid in the configuration file is also a valid long
21       argument. For example, ´ssldir´ is a valid configuration parameter,  so
22       you can specify ´--ssldir directory´ as an argument.
23
24       See   the   configuration   file   documentation  at  http://reductive‐
25       labs.com/projects/puppet/reference/configref.html for the full list  of
26       acceptable  parameters.  A  commented list of all configuration options
27       can also be generated by running puppet cert with ´--genconfig´.
28
29       all: Operate on all items. Currently only makes sense with
30
31
32
33                    ´--sign´, ´--clean´, or ´--list´.
34
35
36
37       digest: Set the digest for fingerprinting (defaults to md5). Valid
38
39
40
41                    values depends on your openssl and openssl ruby extension
42                    version, but should contain at least md5, sha1, md2,
43                    sha256.
44
45
46
47       clean: Remove all files related to a host from puppet cert´s
48
49
50
51                    storage. This is useful when rebuilding hosts, since new
52                    certificate signing requests will only be honored if puppet
53                    cert does not have a copy of a signed certificate for that
54                    host. The certificate of the host remains valid. If ´--all´
55                    is specified then all host certificates, both signed and
56                    unsigned, will be removed.
57
58
59
60       debug: Enable full debugging.
61
62       generate: Generate a certificate for a named client. A
63
64
65
66                    certificate/keypair will be generated for each client named
67                    on the command line.
68
69
70
71       help: Print this help message
72
73       list: List outstanding certificate requests. If ´--all´ is
74
75
76
77                    specified, signed certificates are also listed, prefixed by
78                    ´+´, and revoked or invalid certificates are prefixed by
79                    ´-´ (the verification outcome is printed in parenthesis).
80
81
82
83       print: Print the full-text version of a host´s certificate.
84
85       fingerprint: Print the DIGEST (defaults to md5) fingerprint of a host´s
86
87
88
89                    certificate.
90
91
92
93       revoke: Revoke the certificate of a client. The certificate can be
94
95
96
97                    specified either by its serial number, given as a decimal
98                    number or a hexadecimal number prefixed by ´0x´, or by its
99                    hostname. The certificate is revoked by adding it to the
100                    Certificate Revocation List given by the ´cacrl´ config
101                    parameter. Note that the puppetmasterd needs to be
102                    restarted after revoking certificates.
103
104
105
106       sign: Sign an outstanding certificate request. Unless ´--all´ is
107
108
109
110                    specified, hosts must be listed after all flags.
111
112
113
114       verbose: Enable verbosity.
115
116       version: Print the puppet version number and exit.
117
118       verify: Verify the named certificate against the local CA
119
120
121
122                    certificate.
123
124
125       $ puppet cert  -l  culain.madstop.com  $  puppet  cert  -s  culain.mad‐
126       stop.comLuke  KaniesCopyright  (c) 2005 Puppet Labs, LLC Licensed under
127       the GNU Public License
128
129
130
131                                  August 2010                      PUPPETCA(8)