Puppet Community

I'm not even expecting any automation. I'm fine with running openssh manually if need be

If the Bolt stuff doesn't work, the `extend.sh` script is worth running directly on the Puppet CA host:

<https://github.com/puppetlabs/ca_extend/blob/main/files/extend.sh>

That script tries to create a new CA certificate using the same key and doesn't over-write or update anything --- so it should be safe to run even if it doesn't work for some reason.

Although, definitely take a backup of `/etc/puppetlabs/puppet/ssl/` as your first action.

it seems to hang up on being unable to syncronize the CRL upon server start

The CA cert doesn't need to be owned by the `puppet` user --- just readable by it.

the chown sorted it, but thanks so much for the pointer to the extend.sh script.

slogging through about 4500 servers scp'ing the new CA everywhere.