.\" generated with Ronn/v0.7.3
.\" http://github.com/rtomayko/ronn/tree/0.7.3
.
.TH "PUPPET\-CA" "8" "June 2012" "Puppet Labs, LLC" "Puppet manual"
.
.SH "NAME"
\fBpuppet\-ca\fR \- Local Puppet Certificate Authority management\.
.
.SH "SYNOPSIS"
puppet ca \fIaction\fR
.
.SH "DESCRIPTION"
This provides local management of the Puppet Certificate Authority\.
.
.P
You can use this subcommand to sign outstanding certificate requests, list and manage local certificates, and inspect the state of the CA\.
.
.SH "OPTIONS"
Note that any configuration parameter that\'s valid in the configuration file is also a valid long argument, although it may or may not be relevant to the present action\. For example, \fBserver\fR is a valid configuration parameter, so you can specify \fB\-\-server <servername>\fR as an argument\.
.
.P
See the configuration file documentation at \fIhttp://docs\.puppetlabs\.com/references/stable/configuration\.html\fR for the full list of acceptable parameters\. A commented list of all configuration options can also be generated by running puppet with \fB\-\-genconfig\fR\.
.
.TP
\-\-mode MODE
The run mode to use for the current action\. Valid modes are \fBuser\fR, \fBagent\fR, and \fBmaster\fR\.
.
.TP
\-\-render\-as FORMAT
The format in which to render output\. The most common formats are \fBjson\fR, \fBs\fR (string), \fByaml\fR, and \fBconsole\fR, but other options such as \fBdot\fR are sometimes available\.
.
.TP
\-\-verbose
Whether to log verbosely\.
.
.TP
\-\-debug
Whether to log debug information\.
.
.SH "ACTIONS"
.
.TP
\fBdestroy\fR \-
\fBSYNOPSIS\fR
.
.IP
puppet ca destroy
.
.IP
\fBDESCRIPTION\fR
.
.IP
Undocumented action\.
.
.TP
\fBfingerprint\fR \-
\fBSYNOPSIS\fR
.
.IP
puppet ca fingerprint [\-\-digest ALGORITHM]
.
.IP
\fBDESCRIPTION\fR
.
.IP
Undocumented action\.
.
.IP
\fBOPTIONS\fR
.
.IP
\fI\-\-digest ALGORITHM\fR \- The hash algorithm to use when displaying the fingerprint
.
.TP
\fBgenerate\fR \-
\fBSYNOPSIS\fR
.
.IP
puppet ca generate [\-\-dns\-alt\-names NAMES]
.
.IP
\fBDESCRIPTION\fR
.
.IP
Undocumented action\.
.
.IP
\fBOPTIONS\fR
.
.IP
\fI\-\-dns\-alt\-names NAMES\fR \- The comma\-separated list of alternative DNS names to use for the local host\. When the node generates a CSR for itself, these are added to the request as the desired \fBsubjectAltName\fR in the certificate: additional DNS labels that the certificate is also valid answering as\. This is generally required if you use a non\-hostname \fBcertname\fR, or if you want to use \fBpuppet kick\fR or \fBpuppet resource \-H\fR and the primary certname does not match the DNS name you use to communicate with the host\. This is unnecessary for agents, unless you intend to use them as a server for \fBpuppet kick\fR or remote \fBpuppet resource\fR management\. It is rarely necessary for servers; it is usually helpful only if you need to have a pool of multiple load balanced masters, or for the same master to respond on two physically separate networks under different names\.
.
.TP
\fBlist\fR \- List certificates and/or certificate requests\.
\fBSYNOPSIS\fR
.
.IP
puppet ca list [\-\-[no\-]all] [\-\-[no\-]pending] [\-\-[no\-]signed] [\-\-subject PATTERN]
.
.IP
\fBDESCRIPTION\fR
.
.IP
This will list the current certificates and certificate signing requests in the Puppet CA\. You will also get the fingerprint, and any certificate verification failure reported\.
.
.IP
\fBOPTIONS\fR
.
.IP
\fI\-\-[no\-]all\fR \- Include all certificates and requests\.
.
.IP
\fI\-\-[no\-]pending\fR \- Include pending certificate signing requests\.
.
.IP
\fI\-\-[no\-]signed\fR \- Include signed certificates\.
.
.IP
\fI\-\-subject PATTERN\fR \- Only include certificates or requests where subject matches PATTERN\.
.
.IP
PATTERN is interpreted as a regular expression, allowing complex filtering of the content\.
.
.TP
\fBprint\fR \-
\fBSYNOPSIS\fR
.
.IP
puppet ca print
.
.IP
\fBDESCRIPTION\fR
.
.IP
Undocumented action\.
.
.TP
\fBrevoke\fR \-
\fBSYNOPSIS\fR
.
.IP
puppet ca revoke
.
.IP
\fBDESCRIPTION\fR
.
.IP
Undocumented action\.
.
.TP
\fBsign\fR \-
\fBSYNOPSIS\fR
.
.IP
puppet ca sign [\-\-[no\-]allow\-dns\-alt\-names]
.
.IP
\fBDESCRIPTION\fR
.
.IP
Undocumented action\.
.
.IP
\fBOPTIONS\fR
.
.IP
\fI\-\-[no\-]allow\-dns\-alt\-names\fR \- Whether or not to accept DNS alt names in the certificate request
.
.TP
\fBverify\fR \-
\fBSYNOPSIS\fR
.
.IP
puppet ca verify
.
.IP
\fBDESCRIPTION\fR
.
.IP
Undocumented action\.
.
.SH "COPYRIGHT AND LICENSE"
Copyright 2011 by Puppet Labs Apache 2 license; see COPYING