Re: [Ejbca-develop] EJBCA Puppet integration?

[Gémes G. <ge...@kz...>]

2013-06-16 17:11 keltezéssel, Branko Majic írta:
> On Sat, 15 Jun 2013 12:56:35 +0200
> Gémes Géza <ge...@kz...> wrote:
>
>> 2013-06-15 10:04 keltezéssel, Branko Majic írta:
>>> On Fri, 14 Jun 2013 21:58:57 +0200
>>> Gémes Géza <ge...@kz...> wrote:
>>>
>>>> Hi,
>>>>
>>>> I'm trying to deploy puppet to our network, and as it uses a PKI to
>>>> authenticate client systems I'm interested to know if anyone is using
>>>> EJBCA as an external CA (having all systems an EJBCA signed certificate)
>>>> or as a top level CA (having EJBCA sign the puppetmaster certificate and
>>>> let it sign the certificates of client systems).
>>>>
>>>> Thank you!
>>>>
>>>> Cheers
>>>>
>>>> Geza Gemes
>>> Hello Géza,
>>>
>>> As far as I know, nobody has done this. I've actually been at some
>>> point curious if such thing could be done with Puppet, though. It would
>>> probably be necessary to modularise the certificate-related code in
>>> Puppet and implement a web service-based client in Ruby for use with
>>> EJBCA.
>>>
>>> Best regards
>>>
>>>
>> Hi Branko,
>>
>> I wasn't thinking about a close integration as having puppet ca
>> manipulate ejbca certificates, which would be also nice, but not
>> strictly necessary for integration. Puppet can work without the ca
>> component
>> (http://docs.puppetlabs.com/puppet/3/reference/config_ssl_external_ca.html),
>> at least starting from 3.2. What I was hoping to get confirmation on is
>> that there are adequate EJBCA certificate profiles for signing master
>> and agent certificates and some example scep (e.g. jscep scripts) to
>> renew the certs of master/agent. If no certificate profiles exist, the
>> other working option would be to create a subCA for puppet master.
>>
>> Cheers
>>
>> Geza Gemes
> I haven't had a look at Puppet-created certificates, but my guess you
> could use the standard server and client certificate profiles (SERVER
> and ENDUSER) - the important part is probably just the client/server
> EKU.
>
> Best regards
>
Thank you!

Will try to find out what extended key usage puppet is requiring.

Cheers

Geza Gemes