NAME

       puppet-cert - Manage certificates and requests (Deprecated)

SYNOPSIS

       Standalone  certificate  authority.  Capable  of  generating  certificates,  but  mostly used for signing
       certificate requests from puppet clients.

USAGE

       puppet cert action [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose] [--digest digest] [host]

DESCRIPTION

       Because the puppet master service defaults to not signing client certificate  requests,  this  script  is
       available  for  signing outstanding requests. It can be used to list outstanding requests and then either
       sign them individually or sign all of them.

ACTIONS

       Every action except 'list' and 'generate' requires a hostname to act on, unless  the  '--all'  option  is
       set.

       The most important actions for day-to-day use are 'list' and 'sign'.

       clean  Revoke  a host's certificate (if applicable) and remove all files related to that host from puppet
              cert's storage. This is useful when rebuilding hosts, since new certificate signing requests  will
              only  be  honored  if  puppet  cert does not have a copy of a signed certificate for that host. If
              '--all' is specified then all host certificates, both signed and unsigned, will be removed.

       fingerprint
              Print the DIGEST (defaults to the signing algorithm) fingerprint of a host's certificate.

       generate
              Generate a certificate for a named client. A certificate/keypair will be generated for each client
              named on the command line.

       list   List outstanding certificate requests. If '--all'  is  specified,  signed  certificates  are  also
              listed, prefixed by '+', and revoked or invalid certificates are prefixed by '-' (the verification
              outcome  is  printed in parenthesis). If '--human-readable' or '-H' is specified, certificates are
              formatted in a way to improve human scan-ability. If '--machine-readable' or  '-m'  is  specified,
              output is formatted concisely for consumption by a script.

       print  Print the full-text version of a host's certificate.

       revoke Revoke  the  certificate of a client. The certificate can be specified either by its serial number
              (given as a hexadecimal number prefixed by '0x') or by its hostname. The certificate is revoked by
              adding it to the Certificate Revocation List given by the 'cacrl' configuration option. Note  that
              the puppet master needs to be restarted after revoking certificates.

       sign   Sign  an  outstanding certificate request. If '--interactive' or '-i' is supplied the user will be
              prompted to confirm that they are signing the correct certificate (recommended). If '--assume-yes'
              or '-y' is supplied the interactive prompt will assume the answer of 'yes'.

       verify Verify the named certificate against the local CA certificate.

       reinventory
              Build an inventory of the issued certificates.  This  will  destroy  the  current  inventory  file
              specified by 'cert_inventory' and recreate it from the certificates found in the 'certdir'. Ensure
              the puppet master is stopped before running this action.

OPTIONS

       Note  that any setting that's valid in the configuration file is also a valid long argument. For example,
       'ssldir' is a valid setting, so you can specify '--ssldir directory' as an argument.

       See the configuration file documentation at https://puppet.com/docs/puppet/latest/configuration.html  for
       the  full  list  of  acceptable  parameters.  A  commented  list of all configuration options can also be
       generated by running puppet cert with '--genconfig'.

       --all  Operate on all items. Currently only makes  sense  with  the  'sign',  'list',  and  'fingerprint'
              actions.

       --allow-dns-alt-names
              Sign  a  certificate  request  even if it contains one or more alternate DNS names. If this option
              isn't specified, 'puppet cert sign' will ignore any requests that contain alternate names.

              In general, ONLY certs intended for a Puppet master server should  include  alternate  DNS  names,
              since Puppet agent relies on those names for identifying its rightful server.

              You can make Puppet agent request a certificate with alternate names by setting 'dns_alt_names' in
              puppet.conf  or specifying '--dns_alt_names' on the command line. The output of 'puppet cert list'
              shows any requested alt names for pending certificate requests.

       --allow-authorization-extensions
              Enable the signing of a request with authorization extensions. Such requests are sensitive because
              they can be used to write access rules in Puppet Server. Currently, this  is  the  only  means  by
              which such requests can be signed.

       --digest
              Set  the  digest  for  fingerprinting  (defaults  to the digest used when signing the cert). Valid
              values depends on your openssl and openssl ruby extension version.

       --debug
              Enable full debugging.

       --help Print this help message

       --verbose
              Enable verbosity.

       --version
              Print the puppet version number and exit.

EXAMPLE

       $ puppet cert list
       culain.madstop.com
       $ puppet cert sign culain.madstop.com

AUTHOR

       Luke Kanies

COPYRIGHT

       Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License

Puppet, Inc.                                        May 2022                                      PUPPET-CERT(8)