We're using puppet to manage a group of Ubuntu boxes and will shortly require each of these servers to share a common SSL certificate, in order to serve a site over HTTPS. Naturally, we'd like to use puppet to manage the certificate but are conscious of the fact that putting it in a VCS (from where the puppet master gets its modules) mightn't be a great idea—because of the security implications.

Are there any better solutions anyone is aware of?


Disclosure: I am one of the developers of Puppet.

The general practice is to use a special file server mount that offers the content, and then have an ACL on that allowing only the specific systems to get at the files. That allows you to use a source => 'puppet://...' specification without having to have it come from the same place as the other modules.

You might also look to the hiera-gpg module, as documented here, source here. That allows some protection for the content in terms of exposure, so that only approved people, and folks with sufficient access to the Puppet master they could hack the code to get the data, could read it.

  • Upvote for being a puppet developer (Thanks!) and suggesting doing it the same way I do for this situation. – Doug Feb 15 '12 at 14:05
  • No need to vote up just because I am a developer there; I disclose that so people don't get surprised if they go digging. Thanks, though. :) – Daniel Pittman Feb 15 '12 at 18:26
  • A short update to this: what we eventually ended up doing was to store the SSL certificate in puppet after all—but symmetrically encrypted using GPG. Since the web servers won't be ready for action until they've been deployed to (using Fabric) anyway, we added a step to the deployment process to check for the (encrypted) SSL cert. and decrypt it (prompting for the passphrase). Certificate updates are managed by puppet also. Changes to encrypted cert. contents trigger removal of the decrypted certificate, and the next deploy notices it's missing and decrypts again. – markhellewell Aug 1 '12 at 3:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.