DOKK / manpages / debian 12 / puppetserver / puppetserver-ca.1.en
PUPPETSERVER-CA(1) General Commands Manual PUPPETSERVER-CA(1)

puppetserver-ca - Puppetserver CA management command

puppetserver ca (--help | --version)
puppetserver ca (--verbose) [subcommand] <args>

Manage the Private Key Infrastructure for Puppet Server's built-in Certificate Authority.

Show the help message and exit
Show the version number of the CA utility and exit
Display low-level information

The following subcommands require a running Puppet Server:

Revoke cert(s) and remove related files from CA
Generate a new certificate signed by the CA
List certificates and CSRs
Revoke certificate(s)
Sign certificate request(s)

The following subcommands require Puppet Server to be stopped:

Import an external CA chain and generate server PKI
Setup a self-signed CA chain for Puppet Server
Setup infrastructure CRL based on a node inventory
Migrate the existing CA directory to /etc/puppetserver/ca
Prune the local CRL on disk to remove any duplicated certificates

For more details on the arguments supported by these subcommands, see the "Arguments" section of this man page.

clean:


--certname NAME[,NAME]           One or more comma separated certnames
--config CONF                    Custom path to puppet.conf




enable:


--config CONF                    Path to puppet.conf
--infracrl                       Create auxiliary files for the infrastructure-only CRL




generate:


--certname NAME[,NAME]           One or more comma separated certnames
--config CONF                    Path to puppet.conf
--subject-alt-names NAME[,NAME]  One or more comma separated alt-names for the cert
--ca-client                      Whether this cert will be used to request CA actions
--force                          Suppress errors when signing cert offline
--ttl TTL                        The time-to-live for each cert generated and signed




import:


--config CONF                    Path to puppet.conf
--private-key KEY                Path to PEM encoded key
--cert-bundle BUNDLE             Path to PEM encoded bundle
--crl-chain CHAIN                Path to PEM encoded chain
--certname NAME                  Common name to use for the server cert
--subject-alt-names NAME[,NAME]  One or more comma separated alt-names for the cert




list:


--config CONF                    Custom path to Puppet's config file
--all                            List all certificates
--format FORMAT                  Valid formats are: 'text' (default), 'json'
--certname NAME[,NAME]           List the specified cert(s)




migrate:


--config CONF                    Path to puppet.conf




prune:


--config CONF                    Path to the puppet.conf file on disk




revoke:


--certname NAME[,NAME]           One or more comma separated certnames
--config CONF                    Custom path to puppet.conf




setup:


--config CONF                    Path to puppet.conf
--subject-alt-names NAME[,NAME]  One or more comma separated alt-names for the cert
--ca-name NAME                   Common name to use for the CA signing cert
--certname NAME                  Common name to use for the server cert




sign:


--ttl TTL                        The time-to-live for each cert signed
--certname NAME[,NAME]           The name(s) of the cert(s) to be signed
--config CONF                    Custom path to Puppet's config file
--all                            Operate on all certnames

Bugs can be reported to your distribution's bug tracker or upstream at https://tickets.puppetlabs.com/browse/SERVER

puppetserver(1), puppetserver-gem(1), puppetserver-ruby(1), puppetserver-irb(1), puppetserver-foreground(1),

Louis-Philippe Véronneau

2023