Generating server and client certificates with multiple hostnames

Question

When starting up my Puppet Master for the first time, it automatically generates its own server certificate, which is awesome.

My server's hostname is kungfumaster and the Puppet Master generates a certificate with the common name being:

kungfumaster.mynetwork.com

It also adds the following as subject alternative DNS names:

X509v3 Subject Alternative Name:
    DNS:kungfumaster.mynetwork.com, DNS:puppet, DNS:puppet.mynetwork.com

I don't exactly know how it found out that this domain lives in mynetwork.com, though it does, as hostname doesn't reveal the FQDN with any parameter configuration.

However, the one name it seems to have missed is the unqualified host name kungfumaster. Interestingly enough, it did append a domain for puppet and puppet.mynetwork.com, but it conveniently skipped kungfumaster.

In my startup script for Puppet Master, how do I generate the server's certificate properly, ie: with all of the required DNS names?

Answer 1

Before running anything, use the puppet cert tool to generate certificate names with a specified list of alternate DNS names:

puppet cert generate --dns_alt_names \
    kungfumaster,kungfumaster.mynetwork.com kungfumaster

If you've already generated one, clean it out:

puppet cert clean -a

I still need to figure out how it knows my zone info, but that's another question.