# class Puppet::Application::Cert

### Attributes

all[RW]
ca[RW]
digest[RW]
signed[RW]

### Public Instance Methods

help() click to toggle source

    # File lib/puppet/application/cert.rb, line 54
      def help
        <<-'HELP'

    puppet-cert(8) -- Manage certificates and requests
    ========

    SYNOPSIS
    --------
    Standalone certificate authority. Capable of generating certificates,
    but mostly used for signing certificate requests from puppet clients.

    USAGE
    -----
    puppet cert <action> [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
      [--digest <digest>] [<host>]

    DESCRIPTION
    -----------
    Because the puppet master service defaults to not signing client
    certificate requests, this script is available for signing outstanding
    requests. It can be used to list outstanding requests and then either
    sign them individually or sign all of them.

    ACTIONS
    -------

    Every action except 'list' and 'generate' requires a hostname to act on,
    unless the '--all' option is set.

    * clean:
      Revoke a host's certificate (if applicable) and remove all files
      related to that host from puppet cert's storage. This is useful when
      rebuilding hosts, since new certificate signing requests will only be
      honored if puppet cert does not have a copy of a signed certificate
      for that host. If '--all' is specified then all host certificates,
      both signed and unsigned, will be removed.

    * fingerprint:
      Print the DIGEST (defaults to the signing algorithm) fingerprint of a
      host's certificate.

    * generate:
      Generate a certificate for a named client. A certificate/keypair will
      be generated for each client named on the command line.

    * list:
      List outstanding certificate requests. If '--all' is specified, signed
      certificates are also listed, prefixed by '+', and revoked or invalid
      certificates are prefixed by '-' (the verification outcome is printed
      in parenthesis).

    * print:
      Print the full-text version of a host's certificate.

    * revoke:
      Revoke the certificate of a client. The certificate can be specified either
      by its serial number (given as a hexadecimal number prefixed by '0x') or by its
      hostname. The certificate is revoked by adding it to the Certificate Revocation
      List given by the 'cacrl' configuration option. Note that the puppet master
      needs to be restarted after revoking certificates.

    * sign:
      Sign an outstanding certificate request.

    * verify:
      Verify the named certificate against the local CA certificate.

    OPTIONS
    -------
    Note that any configuration parameter that's valid in the configuration
    file is also a valid long argument. For example, 'ssldir' is a valid
    configuration parameter, so you can specify '--ssldir <directory>' as an
    argument.

    See the configuration file documentation at
    http://docs.puppetlabs.com/references/stable/configuration.html for the
    full list of acceptable parameters. A commented list of all
    configuration options can also be generated by running puppet cert with
    '--genconfig'.

    * --all:
      Operate on all items. Currently only makes sense with the 'sign',
      'clean', 'list', and 'fingerprint' actions.

    * --digest:
      Set the digest for fingerprinting (defaults to the the digest used when
      signing the cert). Valid values depends on your openssl and openssl ruby
      extension version.

    * --debug:
      Enable full debugging.

    * --help:
      Print this help message

    * --verbose:
      Enable verbosity.

    * --version:
      Print the puppet version number and exit.

    EXAMPLE
    -------
        $ puppet cert list
        culain.madstop.com
        $ puppet cert sign culain.madstop.com

    AUTHOR
    ------
    Luke Kanies

    COPYRIGHT
    ---------
    Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License

        HELP
      end

main() click to toggle source

    # File lib/puppet/application/cert.rb, line 178
    def main
      if @all
        hosts = :all
      elsif @signed
        hosts = :signed
      else
        hosts = command_line.args.collect { |h| h.downcase }
      end
      begin
        @ca.apply(:revoke, options.merge(:to => hosts)) if subcommand == :destroy
        @ca.apply(subcommand, options.merge(:to => hosts, :digest => @digest))
      rescue => detail
        Puppet.log_exception(detail)
        exit(24)
      end
    end

parse_options() click to toggle source
Calls superclass method Puppet::Application#parse_options

    # File lib/puppet/application/cert.rb, line 224
    def parse_options
      # handle the bareword subcommand pattern.
      result = super
      unless self.subcommand then
        if sub = self.command_line.args.shift then
          self.subcommand = sub
        else
          puts help
          exit
        end
      end
      result
    end

setup() click to toggle source

    # File lib/puppet/application/cert.rb, line 195
    def setup
      require 'puppet/ssl/certificate_authority'
      exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?

      Puppet::Util::Log.newdestination :console

      if [:generate, :destroy].include? subcommand
        Puppet::SSL::Host.ca_location = :local
      else
        Puppet::SSL::Host.ca_location = :only
      end

      # If we are generating, and the option came from the CLI, it gets added to
      # the data.  This will do the right thing for non-local certificates, in
      # that the command line but *NOT* the config file option will apply.
      if subcommand == :generate
        if Puppet.settings.set_by_cli?(:dns_alt_names)
          options[:dns_alt_names] = Puppet[:dns_alt_names]
        end
      end

      begin
        @ca = Puppet::SSL::CertificateAuthority.new
      rescue => detail
        Puppet.log_exception(detail)
        exit(23)
      end
    end

subcommand() click to toggle source

    # File lib/puppet/application/cert.rb, line 9
    def subcommand
      @subcommand
    end

subcommand=(name) click to toggle source

    # File lib/puppet/application/cert.rb, line 13
    def subcommand=(name)
      # Handle the nasty, legacy mapping of "clean" to "destroy".
      sub = name.to_sym
      @subcommand = (sub == :clean ? :destroy : sub)
    end