| Hi, on puppet master the client's public key needs to be signed with puppet cert sign clientname There's two ways to do it: 1) the interactive way where the sha256 hash sum is shown and a human confirms to have checked this 2) the --assume-yes way to blindly sign a key without verifying. That's insufficent /insecure if clients need to be registered automatically, e.g. with an external script there show be a command like puppet cert sign clientname hashsum or just puppet cert sign hashsum which signs the client only if the hashsum is equal to the one given on command line (e.g. fetched directly from the client) And on the client side there should be some simple command to display the corresponding hash of the cert request, in order to automatically fetch the hash sum from the client and pass it to the master/server to sign that particular hash. regards |
