Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm investigating whether I can somehow make the puppet ecosystem utilize our existing Microsoft Enterprise CA rather than being its own CA.

Since puppet touts that all of the system is "standard SSL", my guess is that it is completely possible to do this without much changing of puppet, HOWEVER it's likely a huge manual headache unless puppet is edited to make the proper calls to the enterprise CA.

Has anyone tried this before? Is it a "here be dragons, turn away!" situation?

share|improve this question
I've not done this before, but the way I would approach this would be to mint a subordinate CA certificate from AD and pre-populate the puppetmaster SSL directories with those files. And hope. – sysadmin1138 Nov 29 '12 at 14:30
How are you expecting the certificates to be issued? Are you expecting the puppet client to somehow request these on its own? – Zoredache Nov 29 '12 at 17:55
up vote 2 down vote accepted

The certificate validation and hierarchy behavior in puppet is indeed standard SSL, but it's kind of a partial implementation of the standards - there's a long-standing feature request out there to improve its support for more complicated deployments.

If the goal is to get certificate issuance and approval moved over to the AD Certificate Services system (and never type puppet cert sign again), then you're probably out of luck without some software development work.

The client uses Puppet's own REST API to handle making certificate requests, fetching signed certificates, AIA and CRL access, etc.; you'd need to implement glue between those API calls and the AD Certificate Services RPC access points.

But, if you're just looking for your Puppet certificates to be in trust chain under your AD CS root, then sysadmin1138's recommendation should work great (though I haven't tested it either - I'll find some time to do that and update you).

The Puppet clients will treat the intermediate Puppet CA as if it were a root CA (which will yield working validation without them needing knowledge of the root), while still being valid descendants of the real root CA.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.