ucbpi/puppet-ssl

Puppet SSL Management Module

puppet-ssl's Issues

Allow wildcard certificates

Hi,
currently wildcart certificates are not allowed. But his is an often used feature.
Is it possible to integrate this feature.

Greetings Jan

Update documentation

The following should be addressed:

• Hiera is now a requirement as of 2.0.0 (I didn't like this idea after all -- not implemented)
• Support for stdlib 2.6 is dropped as of 2.0.0 (commit 819040d)
• Outline of all the public classes/defines and their attributes

Uknown function params_lookup

I get an error when trying to use this module. I have stdlibs 3.2.0. Are there any other modules this module depends on?

ssl class should have proper spec tests defined

nuff said.

Intermediate Cert fail to download using incommon define

Page text is returned, and not the cert

ssl::incommon always queries incommon, even if cert exists

The intention of the code:

$grab_x509 =  "mv -f ${ssl::params::crt_dir}/meta/${cn}.crt.tmp
                         ${ssl::params::crt_dir}/${cn}.crt; 
                         touch ${ssl::params::crt_dir}/meta/${cn}.lock" 
$check_x509 = 
  [ 
    "curl -q --silent ${url_x509} -o ${ssl::params::crt_dir}/meta/${cn}.crt.tmp",
    "cat ${ssl::params::crt_dir}/meta/${cn}.crt.tmp|head -n1|grep 'BEGIN CERTIFICATE'" 
  ]

# check if the cert is ready
exec { "get-cert-${cn}":
  creates => "${ssl::params::crt_dir}/meta/${cn}.lock",
  command => $grab_x509,
  onlyif  => $check_x509,
  path    => [ '/bin', '/usr/bin' ],
}

Is to only check InCommon when the lock file doesn't exist (via the creates parameter). Then, if it exists, it should only run if the downloaded certificate is valid (via the onlyif parameter).

The problem is, you can't use both creates and onlyif at the same time to control whether an exec runs.

On initial generation, a self-signed cert should be generated

Initially, before a signed cert is installed, a self-signed cert should be installed to allow for things depending on it's existence to still run (ie. Apache, Stunnel, etc). Since we submit the CSR generated by this class, under normal circumstances, we will never have a cert ready for the apache/stunnel/etc to read and load. This causes the puppet runs to fail if the service depends on it, and it is managed in puppet.

An option for also generating a loadable intermediate cert should be available as well, even if it's just copying the self-signed cert to the intermediate.crt.