Puppet module to install additional root certificates on RHEL based systems
OTHER License
A puppet module to manage the distribution's trusted certificates and install trusted SSL certificates into the system's trusted keystore and java's keystore's.
Many organizations use self-signed SSL certificates for internal services that need to be trusted by other hosts. This puppet module will install SSL certificates into a host's system-wide trusted CA files (which are used by distribution-provided java packages) as well as a define for installing certificates into java installations not provided by the distribution.
To install trusted_ca
puppet module install jlambert121-trusted_ca
Dependencies:
Manage only distribution-specific trusted certificates
class { 'trusted_ca': }
Install a self-signed SSL certificate into the system's global trusted keystore from a source file
class { 'trusted_ca': }
trusted_ca::ca { 'mycompany.org':
source => 'puppet:///ssl/mycompany.org.crt',
}
Install a self-signed SSL certificate into a java keystore from a source file
class { 'trusted_ca': }
trusted_ca::java { 'mycompany.org':
source => 'puppet:///ssl/mycompany.org/crt',
java_keystore => '/usr/local/java/lib/security/cacerts',
}
Install a certificate into the system's global trusted keystore from a PEM-encoded string (eg from hiera)
class { 'trusted_ca': }
trusted_ca::ca { 'example.net':
content => hiera("example-net-x509"),
}
trusted_ca
certificates_version
String. Version of the distribution-specific trusted certificates. Examples would be 'latest' or a specific version.
certs_package
String. Package name of the distribution-specific trusted certificates. Default is OS/Distribution specific.
path
String/Array of String. List of paths for the update_command
.
install_path
String. Location to install the trusted certificates.
update_command
String. Command to rebuild the system-trusted certificates.
certfile_suffix
String. Suffix of certificate files. Default is OS/Distribution dependent, i.e. 'pem' or 'crt'.
trusted_ca::ca
source
String. Source of the certificate to include. Must be a file in PEM format with crt extension. You must specify either source or content, but not both. If source is specified, content is ignored.
content
String. Content of certificate in PEM format. You must specify either source or content, but not both. If source is specified, content is ignored.
install_path
String. Destination of the certificate file for processing. Defaults to the install_path from the class, but can be overridden per certificate.
certfile_suffix
String. Suffix of certificate files. Default is OS/Distribution dependent, i.e. 'pem' or 'crt'.
trusted_ca::java
source
String. Source of the certificate to include. Must be a file in PEM format with crt extension. You must specify either source or content, but not both. If source is specified, content is ignored.
content
String. Content of certificate in PEM format. You must specify either source or content, but not both. If source is specified, content is ignored.
java_keystore
String. Location of of the java cacerts keystore file.
Tested on:
This module assumes the keytool and openssl utilities are available.
Improvements and bug fixes are greatly appreciated. See the contributing guide for information on adding and validating tests for PRs.