If you really want to cut it down, the

extend.sh

script has no dependencies and also does not modify any existing CA state --- it just creates a new certificate and prints the path to it: github.com/puppetlabs/ca_extend/blob/…/extend.sh