windows_puppet_certificates

Table of Contents

1. Description
2. Usage
3. Reference
4. Changelog
5. Limitations
6. Contributing

Description

This module takes the Puppet Master CA certificate and Puppet Agent client certificate and imports them into the Windows Certificate Store.

This is useful to allow Windows applications to consume these certificates in a Windows way, for example;

• For client certificate based authentication in EAP in 802.1x

• For automatically trusting the PE Console in web browsers

• For encrypting secrets for the client to consume, for example Hiera eYaml

• For encrypting secrets for the server to consume, for example encrypting Bitlocker keys

• For example, you could use it to manage the certificates for SSL winrm (https://forge.puppet.com/nekototori/winrmssl)

Usage

By default the module will only import the Puppet Master CA cert

include windows_puppet_certificates

If you wish to import the master and client certificate you use the following manifest

class { 'windows_puppet_certificates':
  manage_master_cert => true,
  manage_client_cert => true,
}

Reference

This module is documented via pdk bundle exec puppet strings generate --format markdown. Please see REFERENCE.md for more info.

Additionally, a custom fact named puppet_cert_paths is included in this module. A sample of what it adds to the output of puppet facts on Windows is below:

"puppet_cert_paths": {
    "confdir": "C:/ProgramData/PuppetLabs/puppet/etc",
    "ssldir": "C:/ProgramData/PuppetLabs/puppet/etc/ssl",
    "cert_dir": "C:/ProgramData/PuppetLabs/puppet/etc/ssl/certs",
    "ca_path": "C:/ProgramData/PuppetLabs/puppet/etc/ssl/certs/ca.pem",
    "client_cert_path": "C:/ProgramData/PuppetLabs/puppet/etc/ssl/certs/test.example.com.pem",
    "client_key_path": "C:/ProgramData/PuppetLabs/puppet/etc/ssl/private_keys/test.example.com.pem"
},

Changelog

CHANGELOG.md is generated prior to each release via pdk bundle exec rake changelog. This proecss relies on labels that are applied to each pull request.

Limitations

Currently the module only supports ensure => present, that is the module can only add the certificates, and ensure they exist.

Contributing

Pull requests are welcome!