Puppet can use its built-in certificate authority (CA) and public key infrastructure (PKI) tools or use an existing external CA for all of its secure socket layer (SSL) communications.
Puppet uses certificates to verify the the identity of nodes. These certificates are issued by the certificate authority (CA) service of a Puppet master. When a node checks into the Puppet master for the first time, it requests a certificate. The Puppet master examines this request, and if it seems safe, creates a certificate for the node. When the agent node picks up this certificate, it knows it can trust the Puppet master, and it can now identify itself later when requesting a catalog.
After installing the Puppet Server, before starting it for the first time, use the
puppetserver ca setup command to create a default intermediate CA. For more complex use cases, see the Intermediate and External CA documentation.
puppetserver ca setupcreates the old single-cert CA. This configuration is not recommended, so if you are using Puppet 6, use the setup command instead.
Puppet provides two command line tools for performing SSL tasks:
puppetserver casigns certificate requests and revokes certificates.
puppet sslperforms agent-side tasks, such as submitting a certificate request or downloading a node certificate.
What's changed in Puppet 6
Puppet 6 removes the
puppet cert command and its associated certificate-related faces. In Puppet 6 you must use the new subcommands listed above instead.
Puppet 6 also introduces full support for intermediate CAs, the recommended architecture. This requires changes on both the server and the agent, so using it requires both the server and the agent to be updated to Puppet 6.