puppet-tlsfiles

Overview

This module is used to manage Private Key Infrastructure (PKI) Transport Layer Security (TLS) files. Typically these are Secure Socket Layer (SSL) X.509 private keys and certificates.

The module supports installing intermediate certificates as well as optionally joining keys and certificates into single files.

• tlsfiles : Manage key and certificate
• tlsfiles::dehydrated : Manage key and certificate from Dehydrated.

Parameters

• $crtpath = '/etc/pki/tls/certs'
• $keypath = '/etc/pki/tls/private'
• $crtmode = '0644'
• $keymode = '0600'
• $owner = 'root'
• $group = 'root'
• $intcert = false
• $intjoin = false
• $pem = false
• $srcdir = 'tlsfiles'
• $crtdir = 'crt'
• $keydir = 'key'
• crtname = "${title}.crt"
• keyname = "${title}.key"

Examples

To install keys and certificates present under :

• mymodulename/templates/tlsfiles/crt/www.example.com.crt
• mymodulename/templates/tlsfiles/key/www.example.com.key
• mymodulename/templates/tlsfiles/crt/IntermediateCA.crt

In site.pp to centralize all of your files :

Tlsfiles { srcdir => 'mymodulename/tlsfiles' }

Install key and certificate files to the default locations :

tlsfiles { 'www.example.com': }

Install a PEM file containing key and certificate to a custom location (it will be called www.example.com.pem) :

tlsfiles { 'www.example.com':
  keypath => '/etc/foo',
  pem     => true,
}

The same as the above, but including the intermediate CA certificate :

tlsfiles { 'www.example.com':
  keypath => '/etc/foo',
  intcert => 'IntermediateCA',
  pem     => true,
}

Dehydrated

The similar tlsfiles::dehydrated definition is better when using source files generated by Dehydrated.

Just make sure your mymodule/templates/certs/ directory is where Dehydrated manages its certificates (a symlink will do), and use something like:

tlsfiles::dehydrated { 'wildcard.example.com':
  srcdir => 'mymodule/certs',
}

2024-06-11 - 1.0.6

• Support renaming output files in tlsfiles::dehydrated.

2024-06-10 - 1.0.5

• Add tlsfiles::dehydrated to manage dehydrated certs more easily.

2019-01-21 - 1.0.4

• Add ensure parameter so certs can be easily deleted (#8, @forgodssake).

2018-07-17 - 1.0.3

• Add parameters for file names and directories (#7, @forgodssake).

2016-03-22 - 1.0.2

• Fix error when $injoin was true but no $intcert was given.

2015-10-07 - 1.0.1

• Update README.
• Change to using new metadata.json.

2014-11-11 - 1.0.0

• Fix pem when intcert is set.
• Update README.

2013-05-20 - 0.3.0

• Change to 2-space indent.
• Update README and use markdown.

2012-04-08 - 0.2.0

• Clean up the module to match current puppetlabs guidelines.