puppet-certificate - Man Page

Provide access to the CA for certificate management.


puppet certificate action [--terminus _TERMINUS] [--extra HASH] --ca-location LOCATION


This subcommand interacts with a local or remote Puppet certificate authority. Currently, its behavior is not a full superset of puppet cert; specifically, it is unable to mimic puppet cert´s "clean" option, and its "generate" action submits a CSR rather than creating a signed certificate.


Note that any setting that´s valid in the configuration file is also a valid long argument, although it may or may not be relevant to the present action. For example, server and run_mode are valid settings, so you can specify --server <servername>, or --run_mode <runmode> as an argument.

See the configuration file documentation at https://puppet.com/docs/puppet/latest/configuration.html for the full list of acceptable parameters. A commented list of all configuration options can also be generated by running puppet with --genconfig.

--render-as FORMAT

The format in which to render output. The most common formats are json, s (string), yaml, and console, but other options such as dot are sometimes available.


Whether to log verbosely.


Whether to log debug information.

--ca-location LOCATION

Whether to act on the local certificate authority or one provided by a remote puppet master. Allowed values are ´local´ and ´remote.´

This option is required.

--extra HASH

A terminus can take additional arguments to refine the operation, which are passed as an arbitrary hash to the back-end. Anything passed as the extra value is just send direct to the back-end.

--terminus _TERMINUS

Indirector faces expose indirected subsystems of Puppet. These subsystems are each able to retrieve and alter a specific type of data (with the familiar actions of find, search, save, and destroy) from an arbitrary number of pluggable backends. In Puppet parlance, these backends are called terminuses.

Almost all indirected subsystems have a rest terminus that interacts with the puppet master´s data. Most of them have additional terminuses for various local data models, which are in turn used by the indirected subsystem on the puppet master whenever it receives a remote request.

The terminus for an action is often determined by context, but occasionally needs to be set explicitly. See the "Notes" section of this face´s manpage for more details.


To see all the alternate names your servers are using, log into your CA server and run puppet cert list -a, then check the output for (alt names: ...). Most agent nodes should NOT have alternate names; the only certs that should have them are Puppet Server nodes that you want other agents to trust.





Request a certificate for "somenode" from the site´s CA:

$ puppet certificate generate somenode.puppetlabs.lan --ca-location remote


Sign somenode.puppetlabs.lan´s certificate:

$ puppet certificate sign somenode.puppetlabs.lan --ca-location remote


This subcommand is an indirector face, which exposes find, search, save, and destroy actions for an indirected subsystem of Puppet. Valid termini for this face include:


April 2020 Puppet, Inc. Puppet manual