Forge Home

Modules

Puppet

Resources

PuppetEcosystemPuppet CommunityUpdates

trusted_ca

Manages trusted_ca
Project URLRSS FeedReport issues

13,317 downloads

13,317 latest version

4.6 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Support the Puppet Community by contributing to this module

You are welcome to contribute to this module by suggesting new features, currency updates, or fixes. Every contribution is valuable to help ensure that the module remains compatible with the latest Puppet versions and continues to meet community needs. Complete the following steps:

  1. Review the module’s contribution guidelines and any licenses. Ensure that your planned contribution aligns with the author’s standards and any legal requirements.
  2. Fork the repository on GitHub, make changes on a branch of your fork, and submit a pull request. The pull request must clearly document your proposed change.

For questions about updating the module, contact the module’s author.

Version information

  • 1.1.0 (latest)
released Feb 25th 2016
This version is compatible with:
  • , , , , ,

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'jlambert121-trusted_ca', '1.1.0'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add jlambert121-trusted_ca
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install jlambert121-trusted_ca --version 1.1.0

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.

Download
Tags: ssl, trusted-ca

Documentation

jlambert121/trusted_ca — version 1.1.0 Feb 25th 2016

Puppet Forge Build Status

Table of Contents

  1. Overview
  2. Module Description - What the module does and why it is useful
  3. Setup - The basics of getting started with trusted_ca
  4. Usage - Configuration options and additional functionality
  5. Reference - An under-the-hood peek at what the module is doing and how
  6. Limitations - OS compatibility, etc.
  7. Development - Guide for contributing to the module
  8. Changelog/Contributors

Overview

A puppet module to manage the distribution's trusted certificates and install trusted SSL certificates into the system's trusted keystore and java's keystore's.

Module Description

Many organizations use self-signed SSL certificates for internal services that need to be trusted by other hosts. This puppet module will install SSL certificates into a host's system-wide trusted CA files (which are used by distribution-provided java packages) as well as a define for installing certificates into java installations not provided by the distribution.

Setup

What trusted_ca affects

  • Distribution-provided trusted SSL certificates package
  • System-wide additional trusted SSL certificates
  • SSL certificates installed into java trusted certificate keystore

Beginning with trusted_ca

To install trusted_ca

    puppet module install jlambert121-trusted_ca

Dependencies:

  • puppetlabs/stdlib

Usage

Manage only distribution-specific trusted certificates

    class { 'trusted_ca': }

Install a self-signed SSL certificate into the system's global trusted keystore from a source file

    class { 'trusted_ca': }
    trusted_ca::ca { 'mycompany.org':
      source => 'puppet:///ssl/mycompany.org.crt',
    }

Install a self-signed SSL certificate into a java keystore from a source file

    class { 'trusted_ca': }
    trusted_ca::java { 'mycompany.org':
      source => 'puppet:///ssl/mycompany.org/crt',
      java_keystore => '/usr/local/java/lib/security/cacerts',
    }

Install a certificate into the system's global trusted keystore from a PEM-encoded string (eg from hiera)

    class { 'trusted_ca': }
    trusted_ca::ca { 'example.net':
      content => hiera("example-net-x509"),
    }

Reference

Public classes

trusted_ca

certificates_version

String. Version of the distribution-specific trusted certificates. Examples would be 'latest' or a specific version.

certs_package

String. Package name of the distribution-specific trusted certificates. Default is OS/Distribution specific.

path

String/Array of String. List of paths for the update_command.

install_path

String. Location to install the trusted certificates.

update_command

String. Command to rebuild the system-trusted certificates.

certfile_suffix

String. Suffix of certificate files. Default is OS/Distribution dependent, i.e. 'pem' or 'crt'.

Public defines

trusted_ca::ca

source

String. Source of the certificate to include. Must be a file in PEM format with crt extension. You must specify either source or content, but not both. If source is specified, content is ignored.

content

String. Content of certificate in PEM format. You must specify either source or content, but not both. If source is specified, content is ignored.

install_path

String. Destination of the certificate file for processing. Defaults to the install_path from the class, but can be overridden per certificate.

certfile_suffix

String. Suffix of certificate files. Default is OS/Distribution dependent, i.e. 'pem' or 'crt'.

trusted_ca::java

source

String. Source of the certificate to include. Must be a file in PEM format with crt extension. You must specify either source or content, but not both. If source is specified, content is ignored.

content

String. Content of certificate in PEM format. You must specify either source or content, but not both. If source is specified, content is ignored.

java_keystore

String. Location of of the java cacerts keystore file.

Private classes

  • trusted_ca::params: Defaults for the trusted_ca module

Limitations

Tested on:

  • CentOS 6, 7
  • Ubuntu Server 10.04, 12.04, 14.04
  • SLES 11 SP3
  • OpenSuSE 13.1

This module assumes the keytool and openssl utilities are available.

Development

Improvements and bug fixes are greatly appreciated. See the contributing guide for information on adding and validating tests for PRs.

Changelog / Contributors

Changelog Contributors