This module takes the Puppet Master CA certificate and Puppet Agent client certificate and imports them into the Windows Certificate Store.
This is useful to allow Windows applications to consume these certificates in a Windows way, for example;
-
For client certificate based authentication in EAP in 802.1x
-
For automatically trusting the PE Console in web browsers
-
For encrypting secrets for the client to consume, for example Hiera eYaml
-
For encrypting secrets for the server to consume, for example encrypting Bitlocker keys
-
For example, you could use it to manage the certificates for SSL winrm (https://forge.puppet.com/nekototori/winrmssl)
By default the module will only import the Puppet Master CA cert
include windows_puppet_certificatesIf you wish to import the master and client certificate you use the following manifest
class { 'windows_puppet_certificates':
manage_master_cert => true,
manage_client_cert => true,
}This module is documented via
pdk bundle exec puppet strings generate --format markdown.
Please see REFERENCE.md for more info.
Additionally, a custom fact named puppet_cert_paths is included in this
module. A sample of what it adds to the output of puppet facts on
Windows is below:
"puppet_cert_paths": {
"confdir": "C:/ProgramData/PuppetLabs/puppet/etc",
"ssldir": "C:/ProgramData/PuppetLabs/puppet/etc/ssl",
"cert_dir": "C:/ProgramData/PuppetLabs/puppet/etc/ssl/certs",
"ca_path": "C:/ProgramData/PuppetLabs/puppet/etc/ssl/certs/ca.pem",
"client_cert_path": "C:/ProgramData/PuppetLabs/puppet/etc/ssl/certs/test.example.com.pem",
"client_key_path": "C:/ProgramData/PuppetLabs/puppet/etc/ssl/private_keys/test.example.com.pem"
},CHANGELOG.md is generated prior to each release via
pdk bundle exec rake changelog. This proecss relies on labels that are applied
to each pull request.
Currently the module only supports ensure => present, that is the module can only add the certificates, and ensure they exist.
Pull requests are welcome!