Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way I can set a puppet master to auto accept all certs from clients (so I don't have to puppetca on the master each time)?

share|improve this question
If you have a consistent naming scheme you could presign a generate and sign a bunch of keys on the master, and then pull them to the client when you install the client the first time. This might be a bit safer over the autosign. See… – Zoredache Nov 2 '12 at 18:13
up vote 5 down vote accepted

Create a file /etc/puppet/autosign.conf on the master, containing the domain names of the hosts for which you want certificates signed automatically.

share|improve this answer
echo "*" > /etc/puppet/autosign.conf

Or you can be a little more secure (but not really, since a client sets its own cert name; someone wanting illegitimate access to your puppet master would just need to know what name to fake) by limiting it to a specific domain:

echo "*" > /etc/puppet/autosign.conf
share|improve this answer
This is on the master? – Kyle Brandt Nov 2 '12 at 17:31
@KyleBrandt Yup, on the CA master. That file is the default location (or more specifically, $confdir/autosign.conf is the default), but can be changed with the autosign setting in puppet.conf. – Shane Madden Nov 2 '12 at 17:33
@KyleBrandt: Would you like to know more? – Scott Pack Nov 2 '12 at 17:40

I'm personally not a fan of automatically signing these certificates for the reasons already outlined.

I put together a small script kicked off during my kickstarts which runs the following:

echo Configuring local Puppet instance...
/usr/sbin/puppetd --waitforcert 900
sleep 10
echo We will use $HOSTNAME for all future requests...
echo Running server side script..
chvt 1
ssh -q -t $USERNAME@puppetmaster $HOSTNAME
chvt 6

#! /bin/bash

sudo puppetca --sign $NEWHOST

if ! ( cat /etc/puppet/manifests/* | grep "$NEWHOST" )
    echo node \'$NEWHOST\' >>  $NHFILE
    echo  { >> $NHFILE
    echo    include linux_base >>  $NHFILE
    echo  } >> newhost.cfg >>  $NHFILE

I seriously thought about doing something like using a SSL certificate stored on a USB stick for the SSH connection but this proved more convenient.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.