1()                                                                          ()
2
3
4

NAME

6        -
7
8
9

SYNOPSIS

11       Stand-alone  certificate  authority. Capable of generating certificates
12       but mostly meant for signing certificate requests from puppet clients.
13
14
15

USAGE

17       puppetca [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
18              [-g|--generate]    [-l|--list]     [-s|--sign]     [-r|--revoke]
19              [-p|--print] [-c|--clean] [--verify] [host]
20
21
22
23

DESCRIPTION

25       Because  the  puppetmasterd  daemon defaults to not signing client cer‐
26       tificate requests, this script is  available  for  signing  outstanding
27       requests.  It  can be used to list outstanding requests and then either
28       sign them individually or sign all of them.
29
30
31

OPTIONS

33       Note that any configuration parameter that´s valid in the configuration
34       file  is  also  a valid long argument. For example, ´ssldir´ is a valid
35       configuration parameter, so you can specify ´--ssldir  <directory>´  as
36       an argument.
37
38       See   the   configuration   file   documentation  at  http://reductive‐
39       labs.com/projects/puppet/reference/configref.html for the full list  of
40       acceptable  parameters.  A  commented list of all configuration options
41       can also be generated by running puppetca with ´--genconfig´.
42
43
44
45       all: Operate on all outstanding requests. Only makes sense with
46              ´--sign´, or ´--list´.
47
48
49
50       clean: Remove all files related to a host from puppetca´s storage.
51              This is useful when  rebuilding  hosts,  since  new  certificate
52              signing  requests will only be honored if puppetca does not have
53              a copy of a signed certificate for that host. The certificate of
54              the host remains valid.
55
56              debug:    Enable full debugging.
57
58
59
60       generate: Generate a certificate for a named client. A
61              certificate/keypair  will  be generated for each client named on
62              the command line.
63
64              help:     Print this help message
65
66
67
68       list: List outstanding certificate requests. If ´--all´ is
69              specified, signed certificates are also listed, prefixed by ´+´.
70
71              print:    Print the full-text version of a host´s certificate.
72
73
74
75       revoke: Revoke the certificate of a client. The certificate can be
76              specified either by its serial number, given as a decimal number
77              or  a  hexadecimal  number prefixed by ´0x´, or by its hostname.
78              The certificate is revoked by adding it to the Certificate Revo‐
79              cation List given by the ´cacrl´ config parameter. Note that the
80              puppetmasterd needs to be restarted after revoking certificates.
81
82
83
84       sign: Sign an outstanding certificate request. Unless ´--all´ is
85              specified, hosts must be listed after all flags.
86
87              verbose:  Enable verbosity.
88
89              version:  Print the puppet version number and exit.
90
91              verify:   Verify the named certificate against the local CA cer‐
92              tificate.
93
94
95

EXAMPLE

97       $ puppetca -l culain.madstop.com $ puppetca -s culain.madstop.com
98
99
100
101

AUTHOR

103       Luke Kanies
104
105
106

108       Copyright  (c)  2005  Reductive Labs, LLC Licensed under the GNU Public
109       License
110
111
112
113
114
115                                                                            ()
Impressum