2 $caconf = '/etc/ca-certificates.conf'
10 package { 'ca-certificates':
14 file { '/etc/ssl/README':
16 source => 'puppet:///modules/ssl/README',
18 file { '/etc/ca-certificates.conf':
19 source => 'puppet:///modules/ssl/ca-certificates.conf',
20 notify => Exec['refresh_normal_hashes'],
22 file { '/etc/ca-certificates-debian.conf':
24 source => 'puppet:///modules/ssl/ca-certificates-debian.conf',
25 notify => Exec['refresh_ca_debian_hashes'],
27 file { '/etc/ca-certificates-global.conf':
28 source => 'puppet:///modules/ssl/ca-certificates-global.conf',
29 notify => Exec['refresh_ca_global_hashes'],
32 file { '/etc/apt/apt.conf.d/local-ssl-ca-global':
34 source => 'puppet:///modules/ssl/local-ssl-ca-global',
37 file { '/etc/ssl/certs/ssl-cert-snakeoil.pem':
39 notify => Exec['refresh_normal_hashes'],
41 file { '/etc/ssl/private/ssl-cert-snakeoil.key':
45 file { '/etc/ssl/servicecerts':
49 target => '/usr/local/share/ca-certificates/debian.org',
50 notify => Exec['retire_debian_links'],
53 file { '/usr/local/share/ca-certificates/debian.org':
55 source => 'puppet:///modules/ssl/servicecerts/',
56 mode => '0644', # this works; otherwise all files are +x
60 notify => [ Exec['refresh_normal_hashes'], Exec['refresh_ca_global_hashes'] ],
62 file { '/etc/ssl/certs/README':
65 file { '/etc/ssl/ca-debian':
69 file { '/etc/ssl/ca-debian/README':
72 file { '/etc/ssl/ca-global':
76 file { '/etc/ssl/ca-global/README':
79 file { '/etc/ssl/debian':
81 source => 'puppet:///files/empty/',
82 mode => '0644', # this works; otherwise all files are +x
87 file { '/etc/ssl/debian/certs':
91 file { '/etc/ssl/debian/crls':
95 file { '/etc/ssl/debian/certs/thishost.crt':
96 source => "puppet:///modules/ssl/clientcerts/${::fqdn}.client.crt",
97 notify => Exec['refresh_debian_hashes'],
99 file { '/etc/ssl/debian/certs/ca.crt':
100 source => 'puppet:///modules/ssl/clientcerts/ca.crt',
101 notify => Exec['refresh_debian_hashes'],
103 file { '/etc/ssl/debian/crls/ca.crl':
104 source => 'puppet:///modules/ssl/clientcerts/ca.crl',
106 file { '/etc/ssl/debian/certs/thishost-server.crt':
107 source => "puppet:///modules/exim/certs/${::fqdn}.crt",
108 notify => Exec['refresh_debian_hashes'],
111 file { '/etc/ssl/debian/keys/thishost.key':
114 file { '/etc/ssl/debian/keys/thishost-server.key':
117 file { '/etc/ssl/debian/keys':
121 file { '/etc/ssl/private/thishost.key':
122 source => "puppet:///modules/ssl/clientcerts/${::fqdn}.key",
125 require => Package['ssl-cert'],
127 file { '/etc/ssl/private/thishost-server.key':
128 source => "puppet:///modules/exim/certs/${::fqdn}.key",
131 require => Package['ssl-cert'],
134 file { '/usr/local/sbin/update-ca-certificates-dsa':
136 source => 'puppet:///modules/ssl/update-ca-certificates-dsa',
139 exec { 'retire_debian_links':
140 command => 'find -lname "../servicecerts/*" -exec rm {} +',
141 cwd => '/etc/ssl/certs',
143 notify => Exec['refresh_normal_hashes'],
145 exec { 'refresh_debian_hashes':
146 command => 'c_rehash /etc/ssl/debian/certs',
148 require => Package['openssl'],
150 exec { 'refresh_normal_hashes':
151 # NOTE 1: always use update-ca-certificates to manage hashes in
152 # /etc/ssl/certs otherwise /etc/ssl/ca-certificates.crt will
153 # get a hash overriding the hash that would have been generated
154 # for another certificate ... which is problem, comrade
155 # NOTE 2: always ask update-ca-certificates to freshen (-f) the links
156 command => '/usr/sbin/update-ca-certificates -f',
158 require => Package['ca-certificates'],
160 exec { 'refresh_ca_debian_hashes':
161 command => '/usr/local/sbin/update-ca-certificates-dsa --fresh --certsconf /etc/ca-certificates-debian.conf --localcertsdir /dev/null --etccertsdir /etc/ssl/ca-debian --hooksdir /dev/null',
164 Package['ca-certificates'],
165 File['/etc/ssl/ca-debian'],
166 File['/etc/ca-certificates-debian.conf'],
167 File['/usr/local/sbin/update-ca-certificates-dsa'],
170 exec { 'refresh_ca_global_hashes':
171 command => '/usr/local/sbin/update-ca-certificates-dsa --fresh --default --certsconf /etc/ca-certificates-global.conf --etccertsdir /etc/ssl/ca-global --hooksdir /dev/null',
174 Package['ca-certificates'],
175 File['/etc/ssl/ca-global'],
176 File['/etc/ca-certificates-global.conf'],
177 File['/usr/local/sbin/update-ca-certificates-dsa'],