Replacing Puppet 3.8.7 CA certificates

[robertosussex]

Use Case

puppet-3.8.7-1.el7.noarch
puppet-server-3.8.7-1.el7.noarch
puppetlabs-stdlib-4.12.0-1stx.noarch
(ClusterStor-specific puppet packages: trinity-puppet-files, ras-, zabbix-, sma-, dcs-)

Puppet master runs via Apache httpd on port 8140 (not Puppet Server/puppetserver)

• SSL paths are ClusterStor-specific (under /mnt/mgmt/var/lib/puppet/ssl/ca/)

• Nodes on HPC are currently running and have been up since 2022 — any misstep during CA renewal could impact these production nodes if they need to reboot

Describe the Solution You Would Like

Clear steps to replace certificates

Describe Alternatives You've Considered

Use certregen and ca_extend modules but Puppet is too old

[bastelfreak]

@robertosussex if you need some help with this, I suggest to come to the community channels: https://voxpupuli.org/connect/ . puppet 3.8 is really ancient and dead since years, so to find a solution needs some time/discussion.