salt.modules.tls

### Navigation

- index
- modules |
- next |
- previous |
- « SaltStack.org |
- Documentation home
- Full list of builtin execution modules »

# salt.modules.tls

A salt module for SSL/TLS. Can create a Certificate Authority (CA) or use Self-Signed certificates.

REQUIREMENT 1:

Required python modules: PyOpenSSL

REQUIREMENT 2:

Add the following values in /etc/salt/minion for the CA module to function properly:

    ca.cert_base_path: '/etc/pki'

`salt.modules.tls.` `create_ca`(ca_name, bits=2048, days=365, CN='localhost', C='US', ST='Utah', L='Salt Lake City', O='Salt Stack', OU=None, emailAddress='xyz@pdq.net')

  Create a Certificate Authority (CA)

  ca_name
    name of the CA
  bits
    number of RSA key bits, default is 2048
  days
    number of days the CA will be valid, default is 365
  CN
    common name in the request, default is "localhost"
  C
    country, default is "US"
  ST
    state, default is "Utah"
  L
    locality, default is "Centerville", the city where SaltStack originated
  O
    organization, default is "Salt Stack"
  OU
    organizational unit, default is None
  emailAddress
    email address for the CA owner, default is 'xyz@pdq.net'

  Writes out a CA certificate based upon defined config values. If the file already exists, the function just returns assuming the CA certificate already exists.

  If the following values were set:

  ca.cert_base_path='/etc/pki/koji' ca_name='koji'

  the resulting CA would be written in the following location:

      /etc/pki/koji/koji_ca_cert.crt

`salt.modules.tls.` `create_ca_signed_cert`(ca_name, CN, days=365)

  Create a Certificate (CERT) signed by a named Certificate Authority (CA)

  ca_name
    name of the CA
  CN
    common name matching the the certificate signing request
  days
    number of days certficate is valid, default is 365 (1 year)

  Writes out a Certificate (CERT) If the file already exists, the function just returns assuming the CERT already exists.

  The CN must match an existing CSR generated by create_csr. If it does not, this method does nothing.

`salt.modules.tls.` `create_csr`(ca_name, bits=2048, CN='localhost', C='US', ST='Utah', L='Salt Lake City', O='Salt Stack', OU=None, emailAddress='xyz@pdq.net')

  Create a Certificate Signing Request (CSR) for a particular Certificate Authority (CA)

  ca_name
    name of the CA
  bits
    number of RSA key bits, default is 2048
  CN
    common name in the request, default is "localhost"
  C
    country, default is "US"
  ST
    state, default is "Utah"
  L
    locality, default is "Centerville", the city where SaltStack originated
  O
    organization, default is "Salt Stack" NOTE: Must the same as CA certificate or an error will be raised
  OU
    organizational unit, default is None
  emailAddress
    email address for the request, default is 'xyz@pdq.net'

  Writes out a Certificate Signing Request (CSR) If the file already exists, the function just returns assuming the CSR already exists.

  If the following values were set:

  ca.cert_base_path='/etc/pki/koji' ca_name='koji' CN='test.egavas.org'

  the resulting CSR, and corresponding key, would be written in the following location:

  /etc/pki/koji/certs/test.egavas.org.csr /etc/pki/koji/certs/test.egavas.org.key

`salt.modules.tls.` `create_pkcs12`(ca_name, CN, passphrase='')

  Create a PKCS#12 browser certificate for a particular Certificate (CN)

  ca_name
    name of the CA
  CN
    common name matching the the certificate signing request
  passphrase
    used to unlock the PKCS#12 certificate when loaded into the browser

`salt.modules.tls.` `create_self_signed_cert`(tls_dir='tls', bits=2048, days=365, CN='localhost', C='US', ST='Utah', L='Salt Lake City', O='Salt Stack', OU=None, emailAddress='xyz@pdq.net')

  Create a Self-Signed Certificate (CERT)

  tls_dir
    location appended to the ca.cert_base_path, default is 'tls'
  bits
    number of RSA key bits, default is 2048
  CN
    common name in the request, default is "localhost"
  C
    country, default is "US"
  ST
    state, default is "Utah"
  L
    locality, default is "Centerville", the city where SaltStack originated
  O
    organization, default is "Salt Stack" NOTE: Must the same as CA certificate or an error will be raised
  OU
    organizational unit, default is None
  emailAddress
    email address for the request, default is 'xyz@pdq.net'

  Writes out a Self-Signed Certificate (CERT). If the file already exists, the function just returns.

  If the following values were set:

  ca.cert_base_path='/etc/pki/koji' tls_dir='koji' CN='test.egavas.org'

  the resulting CERT, and corresponding key, would be written in the following location:

  /etc/pki/tls/certs/test.egavas.org.crt /etc/pki/tls/certs/test.egavas.org.key

## Comments

comments powered by Disqus

### Navigation

- index
- modules |
- next |
- previous |
- « SaltStack.org |
- Documentation home
- Full list of builtin execution modules »