Version information
This version is compatible with:
- Puppet Enterprise 2023.2.x, 2023.1.x, 2023.0.x, 2021.7.x, 2021.6.x, 2021.5.x, 2021.4.x, 2021.3.x, 2021.2.x, 2021.1.x, 2021.0.x
- Puppet >= 7.0.0 < 8.0.0
- , , , , ,
Start using this module
Add this module to your Puppetfile:
mod 'puppet-openssl', '3.0.0'
Learn more about managing modules with a PuppetfileDocumentation
OpenSSL Puppet Module
This module manages OpenSSL.
Class openssl
Make sure openssl is installed:
include openssl
Specify openssl and ca-certificates package versions:
class { 'openssl':
package_ensure => latest,
ca_certificates_ensure => latest,
}
Create certificates (see the x509 defined type):
class { 'openssl::certificates':
x509_certs => { '/path/to/certificate.crt' => { ensure => 'present',
password => 'j(D$',
template => '/other/path/to/template.cnf',
private_key => '/there/is/my/private.key',
days => 4536,
force => false,},
'/a/other/certificate.crt' => { ensure => 'present', },
}
}
Specify openssl and compat package
class { 'openssl':
package_name => ['openssl', 'openssl-compat', ],
}
Types and providers
This module provides three types and associated providers to manage SSL keys and certificates.
In every case, not providing the password (or setting it to undef, which is the default) means that the private key won't be encrypted with any symmetric cipher so it is completely unprotected.
dhparam
This type allows to generate Diffie Hellman parameters.
Simple usage:
openssl::dhparam { '/path/to/dhparam.pem': }
Advanced options:
openssl::dhparam { '/path/to/dhparam.pem':
size => 2048,
}
ssl_pkey
This type allows to generate SSL private keys.
Simple usage:
ssl_pkey { '/path/to/private.key': }
Advanced options:
ssl_pkey { '/path/to/private.key':
ensure => 'present',
password => 'j(D$',
}
x509_cert
This type allows to generate SSL certificates from a private key. You need to deploy a template
file (templates/cert.cnf.erb
is an example).
Simple usage:
x509_cert { '/path/to/certificate.crt': }
Advanced options:
x509_cert { '/path/to/certificate.crt':
ensure => 'present',
password => 'j(D$',
template => '/other/path/to/template.cnf',
private_key => '/there/is/my/private.key',
days => 4536,
force => false,
subscribe => '/other/path/to/template.cnf',
}
x509_request
This type allows to generate SSL certificate signing requests from a private key. You need to deploy a template
file (templates/cert.cnf.erb
is an example).
Simple usage:
x509_request { '/path/to/request.csr': }
Advanced options:
x509_request { '/path/to/request.csr':
ensure => 'present',
password => 'j(D$',
template => '/other/path/to/template.cnf',
private_key => '/there/is/my/private.key',
force => false,
subscribe => '/other/path/to/template.cnf',
}
cert_file
This type controls a file containing a serialized X.509 certificate. It accepts the source in either PEM
or DER
format and stores it in the desired serialization format to the file.
cert_file { '/path/to/certs/cacert_root1.pem':
ensure => present,
source => 'http://www.cacert.org/certs/root_X0F.der',
format => pem,
}
Attributes:
path
(namevar): path to the file where the certificate should be storedensure
:present
orabsent
source
: the URL the certificate should be downloaded fromformat
: the storage format for the certificate file (pem
order
)
Definitions
openssl::certificate::x509
This definition is a wrapper around the ssl_pkey
, x509_cert
and x509_request
types. It generates a certificate template, then generates the private key, certificate and certificate signing request and sets the owner of the files.
Simple usage:
openssl::certificate::x509 { 'foo':
country => 'CH',
organization => 'Example.com',
commonname => $fqdn,
}
Advanced options:
openssl::certificate::x509 { 'foo':
ensure => present,
country => 'CH',
organization => 'Example.com',
commonname => $fqdn,
state => 'Here',
locality => 'Myplace',
unit => 'MyUnit',
altnames => ['a.com', 'b.com', 'c.com'],
extkeyusage => ['serverAuth', 'clientAuth', 'any_other_option_per_openssl'],
email => 'contact@foo.com',
days => 3456,
base_dir => '/var/www/ssl',
owner => 'www-data',
group => 'www-data',
password => 'j(D$',
force => false,
cnf_tpl => 'my_module/cert.cnf.erb'
}
openssl::export::pkcs12
This definition generates a pkcs12 file:
openssl::export::pkcs12 { 'foo':
ensure => 'present',
basedir => '/path/to/dir',
pkey => '/here/is/my/private.key',
cert => '/there/is/the/cert.crt',
in_pass => 'my_pkey_password',
out_pass => 'my_pkcs12_password',
}
openssl::export::pem_cert
This definition exports PEM certificates from a pkcs12 container:
openssl::export::pem_cert { 'foo':
ensure => 'present',
pfx_cert => '/here/is/my/certstore.pfx',
pem_cert => '/here/is/my/cert.pem',
in_pass => 'my_pkcs12_password',
}
This definition exports PEM certificates from a DER certificate:
openssl::export::pem_cert { 'foo':
ensure => 'present',
der_cert => '/here/is/my/certstore.der',
pem_cert => '/here/is/my/cert.pem',
}
openssl::export::pem_key
This definition exports PEM key from a pkcs12 container:
openssl::export::pem_key { 'foo':
ensure => 'present',
pfx_cert => '/here/is/my/certstore.pfx',
pem_key => '/here/is/my/private.key',
in_pass => 'my_pkcs12_password',
out_pass => 'my_pkey_password',
}
openssl::dhparam
This definition creates a dhparam PEM file:
Simple usage:
openssl::dhparam { '/path/to/dhparam.pem': }
which is equivalent to:
openssl::dhparam { '/path/to/dhparam.pem':
ensure => 'present',
size => 512,
owner => 'root',
group => 'root',
mode => '0644',
}
Advanced usage:
openssl::dhparam { '/path/to/dhparam.pem':
ensure => 'present',
size => 2048,
owner => 'www-data',
group => 'adm',
mode => '0640',
}
Functions
cert_aia_caissuers
The function parses a X509 certificate for the authorityInfoAccess extension and return with the URL found as caIssuers, or nil if no URL or extension found. Invoking as deferred function, this can be used to download the issuer certificate:
file { '/ssl/certs/caissuer.crt':
ensure => file,
source => Deferred('cert_aia_caissuers', ["/etc/ssl/certs/${facts['networking']['fqdn']}.crt"]),
}
Contributing
Please report bugs and feature request using GitHub issue tracker.
For pull requests, it is very much appreciated to check your Puppet manifest with puppet-lint to follow the recommended Puppet style guidelines from the Puppet Labs style guide.
Transfer Notice
This plugin was originally authored by Camptocamp. The maintainer preferred that Puppet Community take ownership of the module for future improvement and maintenance. Existing pull requests and issues were transferred over, please fork and continue to contribute here instead of Camptocamp.
Previously: https://github.com/camptocamp/puppet-openssl
Reference
Table of Contents
Classes
openssl
: Installs openssl and ensures bundled certificate list is world readableopenssl::certificates
: Generates x509 certificates based on class parametersopenssl::configs
: Generates openssl.conf files using manually set defaults or defaults from openssl::configopenssl::packages
: Sets up packages for openssl
Defined types
openssl::certificate::x509
: Creates a certificate, key and CSR according to datas provided.openssl::config
: Generates an openssl.conf file using defaultsopenssl::dhparam
: Creates Diffie Helman parameters.openssl::export::pem_cert
: Export certificate(s) to PEM/x509 formatopenssl::export::pem_key
: Export a key to PEM formatopenssl::export::pkcs12
: Export a key pair to PKCS12 format
Resource types
cert_file
: Manages X.509 certificate files downloaded from a source location, saved in the specified format.dhparam
: A Diffie Helman parameter filessl_pkey
: An SSL private keyx509_cert
: An x509 certificatex509_request
: An x509 certificate signing request
Functions
openssl::cert_aia_caissuers
: Extrating the caIssuers entry from Authority Information Access extension of X509 certificateopenssl::cert_date_valid
: Checks SSL cetificate date validity.
Classes
openssl
Installs openssl and ensures bundled certificate list is world readable
Examples
basic usage
class { 'openssl':
package_name => 'openssl-othername',
package_ensure => latest,
ca_certificates_ensure => latest,
}
Parameters
The following parameters are available in the openssl
class:
package_name
Data type: Optional[String[1]]
openssl package name
Default value: undef
package_ensure
Data type: String[1]
openssl package ensure
Default value: installed
ca_certificates_ensure
Data type: String[1]
ca-certificates package ensure
Default value: installed
openssl::certificates
Generates x509 certificates based on class parameters
Examples
basic usage
class { 'openssl::certificate':
x509_certs => { '/path/to/certificate.crt' => { ensure => 'present',
password => 'j(D$',
template => '/other/path/to/template.cnf',
private_key => '/there/is/my/private.key',
days => 4536,
force => false,},
'/a/other/certificate.crt' => { ensure => 'present', },
}
}
Parameters
The following parameters are available in the openssl::certificates
class:
x509_certs
Data type: Hash
Default value: {}
openssl::configs
Generates openssl.conf files using manually set defaults or defaults from openssl::config
Examples
basic usage
class { 'openssl::configs':
country => 'mycountry',
conffiles => { '/path/to/openssl.conf' => { ensure => 'present',
commonname => 'somewhere.org',
organization => 'myorg' },
'/a/other/openssl.conf' => { ensure => 'present',
commonname => 'somewhere.else.org',
organization => 'myotherorg' },
}
}
Parameters
The following parameters are available in the openssl::configs
class:
owner
group
mode
country
state
locality
organization
unit
email
default_bits
default_md
default_keyfile
basicconstraints
extendedkeyusages
keyusages
subjectaltnames
conffiles
owner
Data type: Optional[String[1]]
default owner for the configuration files
Default value: undef
group
Data type: Optional[String[1]]
default group for the configuration files
Default value: undef
mode
Data type: Optional[String[1]]
default mode for the configuration files
Default value: undef
country
Data type: Optional[String[1]]
default value for country
Default value: undef
state
Data type: Optional[String[1]]
default value for state
Default value: undef
locality
Data type: Optional[String[1]]
default value for locality
Default value: undef
organization
Data type: Optional[String[1]]
default value for organization
Default value: undef
unit
Data type: Optional[String[1]]
default value for unit
Default value: undef
email
Data type: Optional[String[1]]
default value for email
Default value: undef
default_bits
Data type: Optional[Integer]
default key size to generate
Default value: undef
default_md
Data type: Optional[String[1]]
default message digest to use
Default value: undef
default_keyfile
Data type: Optional[String[1]]
default name for the keyfile
Default value: undef
basicconstraints
Data type: Optional[Array]
default version 3 certificate extension basic constraints
Default value: undef
extendedkeyusages
Data type: Optional[Array]
default version 3 certificate extension extended key usage
Default value: undef
keyusages
Data type: Optional[Array]
default version 3 certificate extension key usage
Default value: undef
subjectaltnames
Data type: Optional[Array]
default version 3 certificate extension for alternative names currently supported are IP (v4) and DNS
Default value: undef
conffiles
Data type: Hash
config files to generate
Default value: {}
openssl::packages
Sets up packages for openssl
Defined types
openssl::certificate::x509
Creates a certificate, key and CSR according to datas provided.
Examples
basic usage
openssl::certificate::x509 { 'foo.bar':
ensure => present,
country => 'CH',
organization => 'Example.com',
commonname => $fqdn,
base_dir => '/var/www/ssl',
owner => 'www-data',
}
This will create files "foo.bar.cnf", "foo.bar.crt", "foo.bar.key"
and "foo.bar.csr" in /var/www/ssl/.
All files will belong to user "www-data".
Those files can be used as is for apache, openldap and so on.
If you wish to ensure a key is read-only to a process:
set $key_group to match the group of the process,
and set $key_mode to '0640'.
Parameters
The following parameters are available in the openssl::certificate::x509
defined type:
ensure
country
state
locality
commonname
altnames
extkeyusage
organization
unit
email
days
base_dir
key_size
owner
group
key_owner
key_group
key_mode
password
force
cnf_dir
crt_dir
csr_dir
key_dir
cnf
crt
csr
key
encrypted
ca
cakey
ensure
Data type: Enum['present', 'absent']
ensure wether certif and its config are present or not
Default value: present
country
Data type: String
certificate countryName
state
Data type: Optional[String]
certificate stateOrProvinceName
Default value: undef
locality
Data type: Optional[String]
certificate localityName
Default value: undef
commonname
Data type: String
certificate CommonName
altnames
Data type: Array
certificate subjectAltName. Can be an array or a single string.
Default value: []
extkeyusage
Data type: Array
certificate extended key usage Value | Meaning ----------------|------------------------------------- serverAuth | SSL/TLS Web Server Authentication. clientAuth | SL/TLS Web Client Authentication. codeSigning | Code signing. emailProtection | E-mail Protection (S/MIME). timeStamping | Trusted Timestamping OCSPSigning | OCSP Signing ipsecIKE | ipsec Internet Key Exchange msCodeInd | Microsoft Individual Code Signing (authenticode) msCodeCom | Microsoft Commercial Code Signing (authenticode) msCTLSign | Microsoft Trust List Signing msEFS | Microsoft Encrypted File System
Default value: []
organization
Data type: String
certificate organizationName
unit
Data type: Optional[String]
certificate organizationalUnitName
Default value: undef
email
Data type: Optional[String]
certificate emailAddress
Default value: undef
days
Data type: Integer
certificate validity
Default value: 365
base_dir
Data type: Stdlib::Absolutepath
where cnf, crt, csr and key should be placed. Directory must exist
Default value: '/etc/ssl/certs'
key_size
Data type: Integer
Size of the key to generate.
Default value: 3072
owner
Data type: Variant[String, Integer]
cnf, crt, csr and key owner. User must exist
Default value: 'root'
group
Data type: Variant[String, Integer]
cnf, crt, csr and key group. Group must exist
Default value: 'root'
key_owner
Data type: Optional[Variant[String, Integer]]
key owner. User must exist. defaults to $owner
Default value: undef
key_group
Data type: Optional[Variant[String, Integer]]
key group. Group must exist. defaults to $group
Default value: undef
key_mode
Data type: String
key group.
Default value: '0600'
password
Data type: Optional[String]
private key password. undef means no passphrase will be used to encrypt private key.
Default value: undef
force
Data type: Boolean
whether to override certificate and request if private key changes
Default value: true
cnf_dir
Data type: Optional[Stdlib::Absolutepath]
where cnf should be placed. Directory must exist, defaults to $base_dir.
Default value: undef
crt_dir
Data type: Optional[Stdlib::Absolutepath]
where crt should be placed. Directory must exist, defaults to $base_dir.
Default value: undef
csr_dir
Data type: Optional[Stdlib::Absolutepath]
where csr should be placed. Directory must exist, defaults to $base_dir.
Default value: undef
key_dir
Data type: Optional[Stdlib::Absolutepath]
where key should be placed. Directory must exist, defaults to $base_dir.
Default value: undef
cnf
Data type: Optional[Stdlib::Absolutepath]
override cnf path entirely. Directory must exist, defaults to $cnf_dir/$title.cnf
Default value: undef
crt
Data type: Optional[Stdlib::Absolutepath]
override crt path entirely. Directory must exist, defaults to $crt_dir/$title.crt
Default value: undef
csr
Data type: Optional[Stdlib::Absolutepath]
override csr path entirely. Directory must exist, defaults to $csr_dir/$title.csr
Default value: undef
key
Data type: Optional[Stdlib::Absolutepath]
override key path entirely. Directory must exist, defaults to $key_dir/$title.key
Default value: undef
encrypted
Data type: Boolean
Flag requesting the exported key to be unencrypted by specifying the -nodes option during the CSR generation. Turning off encryption is needed by some applications, such as OpenLDAP. Defaults to true (key is encrypted)
Default value: true
ca
Data type: Optional[Stdlib::Absolutepath]
Path to CA certificate for signing. Undef means no CA will be provided for signing the certificate.
Default value: undef
cakey
Data type: Optional[Stdlib::Absolutepath]
Path to CA private key for signing. Undef mean no CAkey will be provided.
Default value: undef
openssl::config
Generates an openssl.conf file using defaults
Examples
basic usage
openssl::config {'/path/to/openssl.conf':
ensure => 'present',
commonname => 'somewhere.org',
country => 'mycountry',
organization => 'myorg',
}
Parameters
The following parameters are available in the openssl::config
defined type:
ensure
commonname
country
organization
owner
group
mode
state
locality
unit
email
default_bits
default_md
default_keyfile
basicconstraints
extendedkeyusages
keyusages
subjectaltnames
ensure
Data type: Enum['absent','present']
ensure parameter for configfile; defaults to present
Default value: 'present'
commonname
Data type: Variant[String[1], Array[String[1]]]
commonname for config file
country
Data type: String[1]
value for country
organization
Data type: String[1]
value for organization
owner
Data type: Variant[String[1],Integer]
owner for the configuration file
Default value: 'root'
group
Data type: Variant[String[1],Integer]
group for the configuration file
Default value: 'root'
mode
Data type: String[1]
mode for the configuration file
Default value: '0640'
state
Data type: Optional[String[1]]
value for state
Default value: undef
locality
Data type: Optional[String[1]]
value for locality
Default value: undef
unit
Data type: Optional[String[1]]
value for unit
Default value: undef
email
Data type: Optional[String[1]]
value for email
Default value: undef
default_bits
Data type: Integer
key size to generate
Default value: 4096
default_md
Data type: String[1]
message digest to use
Default value: 'sha512'
default_keyfile
Data type: String[1]
name for the keyfile
Default value: 'privkey.pem'
basicconstraints
Data type: Optional[Array]
version 3 certificate extension basic constraints
Default value: undef
extendedkeyusages
Data type: Optional[Array]
version 3 certificate extension extended key usage
Default value: undef
keyusages
Data type: Optional[Array]
version 3 certificate extension key usage
Default value: undef
subjectaltnames
Data type: Optional[Array]
version 3 certificate extension for alternative names currently supported are IP (v4) and DNS
Default value: undef
openssl::dhparam
Creates Diffie Helman parameters.
Parameters
The following parameters are available in the openssl::dhparam
defined type:
path
Data type: Stdlib::Absolutepath
path to write DH parameters to
Default value: $name
ensure
Data type: Enum['present', 'absent']
ensure whether DH paramers file is present or absent
Default value: present
size
Data type: Integer[1]
number of bits for the parameter set
Default value: 2048
owner
Data type: Variant[String, Integer]
file owner. User must exist
Default value: 'root'
group
Data type: Variant[String, Integer]
file group. Group must exist
Default value: 'root'
mode
Data type: String
file mode.
Default value: '0644'
fastmode
Data type: Boolean
Use "fastmode" for dhparam generation
Default value: false
openssl::export::pem_cert
Export certificate(s) to PEM/x509 format
Parameters
The following parameters are available in the openssl::export::pem_cert
defined type:
ensure
Data type: Enum['present', 'absent']
Whether the certificate file should exist
Default value: present
pfx_cert
Data type: Optional[Stdlib::Absolutepath]
PFX certificate/key container
Default value: undef
der_cert
Data type: Optional[Stdlib::Absolutepath]
DER certificate
Default value: undef
pem_cert
Data type: Stdlib::Absolutepath
PEM/x509 certificate
Default value: $title
in_pass
Data type: Optional[String]
PFX password
Default value: undef
openssl::export::pem_key
Export a key to PEM format
Parameters
The following parameters are available in the openssl::export::pem_key
defined type:
pfx_cert
Data type: Stdlib::Absolutepath
PFX certificate/key container
pem_key
Data type: Stdlib::Absolutepath
PEM certificate
Default value: $title
ensure
Data type: Enum['present', 'absent']
Whether the key file should exist
Default value: present
in_pass
Data type: Optional[String]
PFX container password
Default value: undef
out_pass
Data type: Optional[String]
PEM key password
Default value: undef
openssl::export::pkcs12
Export a key pair to PKCS12 format
Parameters
The following parameters are available in the openssl::export::pkcs12
defined type:
basedir
Data type: Stdlib::Absolutepath
Directory where you want the export to be done. Must exists
pkey
Data type: Stdlib::Absolutepath
Private key
cert
Data type: Stdlib::Absolutepath
Certificate
ensure
Data type: Enum['present', 'absent']
Whether the PKCS12 file should exist
Default value: present
in_pass
Data type: Optional[String]
Private key password
Default value: undef
out_pass
Data type: Optional[String]
PKCS12 password
Default value: undef
chaincert
Data type: Optional[String]
Chain certificate to include in pkcs12
Default value: undef
Resource types
cert_file
Manages X.509 certificate files downloaded from a source location, saved in the specified format.
Properties
The following properties are available in the cert_file
type.
ensure
Valid values: present
, absent
The basic property that the resource should be in.
Default value: present
Parameters
The following parameters are available in the cert_file
type.
format
Valid values: der
, pem
Format in which the loaded certificate should be written to file.
Default value: pem
path
Path to the file to manage
provider
The specific backend to use for this cert_file
resource. You will seldom need to specify this --- Puppet will usually
discover the appropriate provider for your platform.
source
The source file
dhparam
A Diffie Helman parameter file
Properties
The following properties are available in the dhparam
type.
ensure
Valid values: present
, absent
The basic property that the resource should be in.
Default value: present
Parameters
The following parameters are available in the dhparam
type.
fastmode
Enable fast mode
Default value: false
path
The path of the file
provider
The specific backend to use for this dhparam
resource. You will seldom need to specify this --- Puppet will usually
discover the appropriate provider for your platform.
size
Valid values: %r{\d+}
The key size
Default value: 512
ssl_pkey
An SSL private key
Properties
The following properties are available in the ssl_pkey
type.
ensure
Valid values: present
, absent
The basic property that the resource should be in.
Default value: present
Parameters
The following parameters are available in the ssl_pkey
type.
authentication
Valid values: rsa
, dsa
, ec
The authentication algorithm: 'rsa', 'dsa or ec'
Default value: rsa
curve
The EC curve
Default value: secp384r1
password
The optional password for the key
path
The path to the key
provider
The specific backend to use for this ssl_pkey
resource. You will seldom need to specify this --- Puppet will usually
discover the appropriate provider for your platform.
size
Valid values: %r{\d+}
The key size
Default value: 2048
x509_cert
An x509 certificate
Properties
The following properties are available in the x509_cert
type.
ensure
Valid values: present
, absent
The basic property that the resource should be in.
Default value: present
Parameters
The following parameters are available in the x509_cert
type.
authentication
Valid values: rsa
, dsa
, ec
The authentication algorithm: 'rsa', 'dsa or ec'
Default value: rsa
ca
The optional ca certificate filepath
cakey
The optional ca private key filepath
csr
The optional certificate signing request path
days
Valid values: %r{\d+}
The validity of the certificate
Default value: 3650
force
Valid values: true
, false
Whether to replace the certificate if the private key mismatches
Default value: false
password
The optional password for the private key
path
The path to the certificate
private_key
The path to the private key
provider
The specific backend to use for this x509_cert
resource. You will seldom need to specify this --- Puppet will usually
discover the appropriate provider for your platform.
req_ext
Valid values: true
, false
Whether adding v3 SAN from config
Default value: false
template
The template to use
x509_request
An x509 certificate signing request
Properties
The following properties are available in the x509_request
type.
ensure
Valid values: present
, absent
The basic property that the resource should be in.
Default value: present
Parameters
The following parameters are available in the x509_request
type.
authentication
Valid values: rsa
, dsa
, ec
The authentication algorithm: 'rsa', 'dsa' or ec
Default value: rsa
encrypted
Valid values: true
, false
Whether to generate the key unencrypted. This is needed by some applications like OpenLDAP
Default value: true
force
Valid values: true
, false
Whether to replace the certificate if the private key mismatches
Default value: false
password
The optional password for the private key
path
The path of the certificate signing request
private_key
The path of the private key
provider
The specific backend to use for this x509_request
resource. You will seldom need to specify this --- Puppet will
usually discover the appropriate provider for your platform.
template
The template to use
Functions
openssl::cert_aia_caissuers
Type: Ruby 4.x API
Extract a X509 certificate for x509v3 extensions, search for Authority Information Access extension and return the contents caIssuers access method. For details see rfc5280#section-4.2.2.
Parameter: path to ssl certificate
openssl::cert_aia_caissuers(String $certfile)
Extract a X509 certificate for x509v3 extensions, search for Authority Information Access extension and return the contents caIssuers access method. For details see rfc5280#section-4.2.2.
Parameter: path to ssl certificate
Returns: Any
contents of the caIssuers access method of authorityInfoAccess extension, or nil if not found
certfile
Data type: String
Path to the certificate to inspect
openssl::cert_date_valid
Type: Ruby 4.x API
Parameter: path to ssl certificate
openssl::cert_date_valid(String $certfile)
Parameter: path to ssl certificate
Returns: Any
false if the certificate is expired or not yet valid,
certfile
Data type: String
The certificate file to check.
Changelog
All notable changes to this project will be documented in this file. Each new release typically also includes the latest modulesync defaults. These should not affect the functionality of the module.
v3.0.0 (2024-03-05)
Breaking changes:
- Require puppetlabs-stdlib 9.x #165 (smortex)
- moves config management to config provider for X509 certificate; moves certificate from v1 to v3 #164 (zilchms)
- Drop Puppet 6 support #163 (zilchms)
- add puppet7 support; namespace all functions #162 (zilchms)
- enable single config file support #159 (zilchms)
- Enlarge key size based on new security requirement #143 (Vampouille)
Implemented enhancements:
- move from own regex to stdlib ip type adding ipv6 support for SANS #166 (zilchms)
- refactor x509_request to be consistent with x509_cert provider #155 (zilchms)
- add ability to certificate provider to get signed against a CA cert #153 (zilchms)
- Allow cert_file to download certificates via https #146 (rtib)
Fixed bugs:
- templates/cert.cnf.erb should use @, not $ #149 (mikerenfro)
- fix openssl_version on EL8 OpenSSL 1.1.1k #135 (fraenki)
Closed issues:
Merged pull requests:
v2.0.1 (2022-03-09)
Fixed bugs:
Closed issues:
- openssl_version fact resolves to nil #134
Merged pull requests:
- Rework README.md/add correct badges #141 (bastelfreak)
- Tests: Use modern rspec syntax #140 (bastelfreak)
- puppet-lint: fix current violations #138 (bastelfreak)
- init: fix Puppet Strings docs syntax #137 (kenyon)
- puppet-lint: fix top_scope_facts warnings #133 (bastelfreak)
- allow stdlib 8.0.0 #130 (kenyon)
2.0.0 (2021-05-04)
Breaking changes:
Implemented enhancements:
- add cert_file type #124 (rtib)
- Allow DER certificates to be converted to PEM format #122 (n3mawashi)
- function to extract caIssuers URL from authorityInfoAccess extension #120 (rtib)
- Allow openssl_version regex to match more FIPS versions #112 (runejuhl)
Closed issues:
- Parameters for openssl.cnf #41
Merged pull requests:
- readd dependencies to class to generate configs #119 (trefzer)
- add autorequire for file path to all defined types #117 (trefzer)
- add class to generate configs #116 (trefzer)
- add support for OpenBSD #115 (trefzer)
- fix spec test, failing Time.now is not executed in same second #114 (trefzer)
- allow for numeric owner and group IDs for file resources #113 (kenyon)
1.14.0 (2020-03-05)
Breaking changes:
Implemented enhancements:
Closed issues:
- 1.13.0 introduced bug in
openssl::export::pkcs12
#110
1.13.0 (2020-01-07)
Implemented enhancements:
- Rubocop #108 (raphink)
- Port specs to rspec 3 #107 (raphink)
- Port cert_date_valid function to Puppet 4.x API #106 (raphink)
- Convert to PDK #105 (raphink)
- Manifests cleanup #104 (raphink)
1.12.0 (2019-04-17)
Implemented enhancements:
1.11.0 (2019-03-01)
Implemented enhancements:
- Ability to generate x509 certificates with extKeyUsage #96 (madchap)
- Add the x509_extensions directive to support SAN in certificate #89 (johnbillion)
- Changes to support unencrypted CSRs #84 (WetHippie)
Closed issues:
- dhparam doesn't work without 'ensure' #90
- Request for ability to create unencrypted private key #83
- Can't add SAN records #44
Merged pull requests:
1.10.0 (2017-04-18)
Breaking changes:
- Make the $fastmode parameter for openssl::dhparam default to false. #86 (rpasing)
- Fastmode, Default Keysize increased, path defaults to name #80 (c33s)
Implemented enhancements:
- Data types #87 (raphink)
- Add definitions to export PEM cert/key from PKCS12 container #85 (michalmiddleton)
Closed issues:
1.9.0 (2017-01-10)
Implemented enhancements:
Closed issues:
- x509_request doesn't handle refresh #71
Merged pull requests:
- Error: Unknown authentication type 'dsa' when setting authentication #72 (christophelec)
1.8.2 (2016-08-19)
1.8.1 (2016-08-19)
Closed issues:
- Error "failure to load inifile" resulting in failed Puppet run #63
Merged pull requests:
1.8.0 (2016-08-18)
Merged pull requests:
- Add argument key_size to openssl::certificate::x509 #55 (kronos-pbrideau)
1.7.2 (2016-06-29)
Closed issues:
- dhparam generation fails #58
Merged pull requests:
1.7.1 (2016-03-30)
Closed issues:
- Error: Facter: error while resolving custom fact "openssl_version" #62
Merged pull requests:
- fixes #62 - error resolving openssl_version on RHEL 6 #66 (mike-es)
- altnames can represent ip addresses #61 (garrettrowell)
1.7.0 (2016-03-18)
Closed issues:
- Add openssl_version fact #57
Merged pull requests:
1.6.1 (2016-02-22)
Merged pull requests:
1.6.0 (2016-02-18)
Implemented enhancements:
- dhparam: add #53 (josephholsten)
- Change cert existance logic #51 (sorrowless)
1.5.1 (2015-11-17)
Implemented enhancements:
- packages: switch to stlib ensure_packages() to play nice with other modules which install ca-certificates #52 (josephholsten)
- Manage ca-certificates package on redhat too #49 (edestecd)
Closed issues:
- ca-certificates package is available in redhat also #47
1.5.0 (2015-09-23)
Implemented enhancements:
1.4.0 (2015-09-15)
Merged pull requests:
- Fix san use in certificate #50 (sorrowless)
1.3.10 (2015-08-21)
Closed issues:
- No way to set desired openssl package version #35
Merged pull requests:
1.3.9 (2015-06-26)
1.3.8 (2015-05-28)
1.3.7 (2015-05-26)
1.3.6 (2015-05-26)
Merged pull requests:
1.3.5 (2015-05-25)
1.3.4 (2015-05-13)
1.3.3 (2015-05-12)
1.3.2 (2015-04-27)
1.3.1 (2015-04-17)
1.3.0 (2015-04-03)
Closed issues:
- Google has depreciated sha1 for certs #36
Merged pull requests:
1.2.8 (2015-03-24)
1.2.7 (2015-03-10)
Merged pull requests:
1.2.6 (2015-02-18)
1.2.5 (2015-01-19)
1.2.4 (2015-01-07)
1.2.3 (2015-01-05)
1.2.2 (2014-12-18)
1.2.1 (2014-12-18)
1.2.0 (2014-12-09)
1.1.0 (2014-11-25)
Closed issues:
- Generating pkcs12 Certificate #33
Merged pull requests:
- Pkcs12 modifications #34 (cjeanneret)
1.0.1 (2014-11-17)
1.0.0 (2014-10-20)
Closed issues:
- Improve doc to show how to generate password-free certs #30
Merged pull requests:
0.3.2 (2014-09-23)
0.3.1 (2014-07-04)
Merged pull requests:
0.3.0 (2014-07-02)
Closed issues:
- RANDFILE not correct on ubuntu 12.04.04 #29
- Add the ability to specify the version of openssl that you want installed #24
- Push new version to the Forge #22
- Fix dependency issue with puppetlabs-stdlib (version number wrong) #17
- creating a cert doesn't include altnames #13
0.2.0 (2014-03-03)
Closed issues:
- Replace has_variable? test with simple if @var test in templates/cert.cnf.erb #16
- incorrect check against undef in default template #15
- Wrong command called #1
Merged pull requests:
- Fix bug with x509_Request not having the cnf template present #28 (jrnt30)
- Document 'group' parameter #27 (pataquets)
- Add 'group' parameter to x509 certificate. #26 (pataquets)
- Added certificate signing request dependency on configuration template #25 (tylerwalts)
- Fix for issue 16 #21 (ghost)
- Ignore Gemfile.lock #20 (ghost)
- Deprecation warnings when running rake spec #19 (ghost)
- Deprecation warning when running bundle install #18 (ghost)
- Add cnf_tpl param to openssl::certificate::x509. #12 (Sliim)
- Fix puppet-lint link in README.md #11 (Sliim)
- Update Modulefile to work with other modules requiring stdlib #10 (LarsFronius)
- Add x509_cert and x509_csr types and providers #9 (raphink)
- Export pkcs12 without password #8 (raphink)
- openssl: added support for various distributions. #5 (mfournier)
- openssl::export::pkcs12 - new definition. name says it all #3 (cjeanneret)
- openssl::certificate::x509 - corrected call to script #2 (cjeanneret)
* This Changelog was automatically generated by github_changelog_generator
Dependencies
- puppetlabs/stdlib (>= 9.0.0 < 10.0.0)
Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.