Jira (PUP-2801) 'puppetca' needs feature to remove (/revoke) a pending certificate signing request

[Daniel Dreier (JIRA)]

Title: Message Title

Daniel Dreier commented on an issue   Re: 'puppetca' needs feature to remove (/revoke) a pending certificate signing request I think you're looking for the "puppet ca destroy machinename" command: [root@poss-head-centos ~]# puppet ca list centos-65-latest.boxnet (SHA256) 60:C0:F3:D6:A9:76:B9:B5:A6:16:68:A5:BF:92:97:20:3D:BC:AC:67:E8:5E:19:50:CE:08:4A:F7:26:38:11:22 [root@poss-head-centos ~]# puppet ca destroy centos-65-latest.boxnet Notice: Removing file Puppet::SSL::CertificateRequest centos-65-latest.boxnet at '/etc/puppet/ssl/ca/requests/centos-65-latest.boxnet.pem' Deleted for centos-65-latest.boxnet: Puppet::SSL::CertificateRequest [root@poss-head-centos ~]# puppet ca list [root@poss-head-centos ~]# The reason that revoking an unsigned CSR can't (and won't) work is because the revocation list is based on the serial number of the signed certificate. The serial number is issued by the CA as part of signing the certificate. You'd have to sign the CSR first and then revoke it in order to get the expected behavior. Perhaps better documentation is needed for this. "puppet help ca" describes the destroy command as "undocumented action" as of the latest master. Do you think that using the "puppet ca destroy" command works for your use case? Add Comment   Puppet / PUP-2801 'puppetca' needs feature to remove (/revoke) a pending certificate signing request It is not possible to remove a pending certificate signing request with 'puppetca --revoke $fqdn': <pre> [root@X puppet]# puppetca --list rhel32bit.x.local [root@X puppet]# puppetca --revoke rhel32bit.x.local rhel32bit.x.local notice: Revoked certificate with serial # Inventory of signed certificates err: Could not call revoke: Cannot convert i... This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.