Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it a bad idea to distribute Apache SSL certificates via puppet? Is it insecure to do it this way? Is there a better way to distribute SSL certs to lots of servers?

share|improve this question
up vote 2 down vote accepted

I've seen this done before. It's only as insecure as your network/destination servers make it. Only you know that. Are you transmitting these over a secure network? If so, you SHOULD be fine. But we can't possibly guarantee that. Why not write a simple ssh script to distribute them? That's what I would recommend. Or write a script to download the cert from a central server and distribute the script via puppet. Just an idea.

EDIT: Since there is some confusion. I'm NOT saying Puppet/SSH are anymore secure. But if you're worried about unauthorized access, ensure everything is secure. This is most easily done with a custom SSH script YOU distribute.

share|improve this answer
Why would SSH be any more secure? Puppet uses SSL for the transport, and RSA keys to authenticate a puppet client. Puppet should be as secure as SSH. Puppet IS a tool to download the cert from a central server. That is exactly its function. If you already have puppet in place, building another system to do the same thing doesn't seem like a good idea. – Zoredache Feb 28 '12 at 1:50
The puppet master isn't hosted on the same ISP/datacenter, so transmission is over the internet, but puppet does use SSL. I just don't know how hard it would be someone to request the certs from my puppet master without me knowing. – Noodles Feb 28 '12 at 1:59
@Zoredache I think you misinterpreted what I said. – Publiccert Feb 28 '12 at 2:07
@Publiccert Puppet agent/master communication uses client certificate authentication; it won't feed manifest or file data to unauthenticated clients unless it's been configured to do so. – Shane Madden Feb 28 '12 at 4:50
Are there any authorization rules applied to the stored SSL certificates, or can ANY client with a valid client certificate fetch ANY stored SSL certificate or other key/password? – kgilpin Oct 15 '13 at 19:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.