The console uses a certificate signed by PE's built-in certificate authority (CA). Because this CA is specific to PE, web browsers don't know it or trust it, and you have to add a security exception in order to access the console. You might find that this is not an acceptable scenario and want to use a custom CA to create the console's certificate.
- You should have a X.509 cert, signed by the custom party CA, in PEM format, with matching private and public keys.
- If your custom cert is issued by an intermediate CA, the CA bundle needs to contain a complete chain, including the applicable root CA.
- The keys and certs used in this procedure must be in PEM format.
- Retrieve the custom certificate's public and private keys.
Move the public key to
/etc/puppetlabs/puppet/ssl/certs/console-cert.pem, replacing any existing file named
Move the private key to
/etc/puppetlabs/puppet/ssl/private_keys/console-cert.pem, replacing any existing file named
puppet agent -t
You can navigate to your console and see the custom certificate in your browser.