@Charlie Sharpsteen as I know you have looked at a lot of the CA stuff… are you aware of any plans around CA renewal / extensions? I ask because of this blurbe Claude wrote me:

The CA certificate itself is valid for 15 years, the

ca_ttl

default at

puppetserver ca setup

(root and intermediate alike), with a

ca_extend

renewal planned about five years before expiry. OpenVox has no renew command; the upstream way to extend it is

puppetlabs/ca_extend

, which keeps the same key, so every signed certificate stays valid and agents fetch the renewed CA themselves (

ca_refresh_interval

, daily) as long as their copy hasn’t expired

is

ca_extend

“the way” here too or have I missed something?