Forge Home


A Puppet module to import the puppet certificates into the machine certificate store in Windows


7,751 latest version

2.9 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 0.2.2 (latest)
  • 0.2.1
  • 0.1.0
released Nov 26th 2020
This version is compatible with:
  • Puppet Enterprise 2019.8.x, 2019.7.x, 2019.5.x, 2019.4.x, 2019.3.x, 2019.2.x, 2019.1.x, 2019.0.x, 2018.1.x, 2017.3.x, 2017.2.x, 2017.1.x, 2016.5.x, 2016.4.x
  • Puppet >= 4.7.0 < 7.0.0

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'puppetlabs-windows_puppet_certificates', '0.2.2'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add puppetlabs-windows_puppet_certificates
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install puppetlabs-windows_puppet_certificates --version 0.2.2

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.



puppetlabs/windows_puppet_certificates — version 0.2.2 Nov 26th 2020

Build Status


Table of Contents

  1. Description
  2. Usage
  3. Reference
  4. Changelog
  5. Limitations
  6. Contributing


This module takes the Puppet Master CA certificate and Puppet Agent client certificate and imports them into the Windows Certificate Store.

This is useful to allow Windows applications to consume these certificates in a Windows way, for example;

  • For client certificate based authentication in EAP in 802.1x

  • For automatically trusting the PE Console in web browsers

  • For encrypting secrets for the client to consume, for example Hiera eYaml

  • For encrypting secrets for the server to consume, for example encrypting Bitlocker keys

  • For example, you could use it to manage the certificates for SSL winrm (


By default the module will only import the Puppet Master CA cert

include windows_puppet_certificates

If you wish to import the master and client certificate you use the following manifest

class { 'windows_puppet_certificates':
  manage_master_cert => true,
  manage_client_cert => true,


This module is documented via pdk bundle exec puppet strings generate --format markdown. Please see for more info.

Additionally, a custom fact named puppet_cert_paths is included in this module. A sample of what it adds to the output of puppet facts on Windows is below:

"puppet_cert_paths": {
    "confdir": "C:/ProgramData/PuppetLabs/puppet/etc",
    "ssldir": "C:/ProgramData/PuppetLabs/puppet/etc/ssl",
    "cert_dir": "C:/ProgramData/PuppetLabs/puppet/etc/ssl/certs",
    "ca_path": "C:/ProgramData/PuppetLabs/puppet/etc/ssl/certs/ca.pem",
    "client_cert_path": "C:/ProgramData/PuppetLabs/puppet/etc/ssl/certs/",
    "client_key_path": "C:/ProgramData/PuppetLabs/puppet/etc/ssl/private_keys/"

Changelog is generated prior to each release via pdk bundle exec rake changelog. This proecss relies on labels that are applied to each pull request.


Currently the module only supports ensure => present, that is the module can only add the certificates, and ensure they exist.


Pull requests are welcome!