API access without using TLS for VMware Orchestrator

[Erling Ringen Elvsrud]

Hi!

We use VMware Orchestrator for provisioning and needs to integrate it with Puppet Enterprise 3.7.2.

Orchestrator needs to access the certificate_status API endpoint like this (just an example with curl):

curl --insecure -H "Accept: pson" https://mypuppetca.local/8140/production/certificate_status/<mynode>

In https://docs.puppetlabs.com/pe/3.7/puppet_server_config_files.html in the ca-section I see that
I can set authorization-required to false, but It looks like this opens the certificate_status endpoint to any server!

I have tried to limit the allowed ip-adresses to one:

In /etc/puppetlabs/puppet/auth.conf I have added to the top:

path /certificate_status
method find, search, save, destroy
auth any
allow_ip 192.168.1.10

But still other servers than 192.168.1.10 can connect!

What is your recommended configuration to give access to /certificate_status to a few ip-adresses whithout using TLS?

Thanks,

Erling