# salt.modules.tls

A salt module for SSL/TLS. Can create a Certificate Authority (CA) or use Self-Signed certificates.

depends: | PyOpenSSL Python module
configuration: | Add the following values in /etc/salt/minion for the CA module to function properly:
    ca.cert_base_path: '/etc/pki'

`salt.modules.tls.` `create_ca`(ca_name, bits=2048, days=365, CN='localhost', C='US', ST='Utah', L='Salt Lake City', O='SaltStack', OU=None, emailAddress='xyz@pdq.net')

  Create a Certificate Authority (CA)

  ca_name
    name of the CA
  bits
    number of RSA key bits, default is 2048
  days
    number of days the CA will be valid, default is 365
  CN
    common name in the request, default is "localhost"
  C
    country, default is "US"
  ST
    state, default is "Utah"
  L
    locality, default is "Centerville", the city where SaltStack originated
  O
    organization, default is "SaltStack"
  OU
    organizational unit, default is None
  emailAddress
    email address for the CA owner, default is 'xyz@pdq.net'

  Writes out a CA certificate based upon defined config values. If the file already exists, the function just returns assuming the CA certificate already exists.

  If the following values were set:

      ca.cert_base_path='/etc/pki'
      ca_name='koji'

  the resulting CA, and corresponding key, would be written in the following location:

      /etc/pki/koji/koji_ca_cert.crt
      /etc/pki/koji/koji_ca_cert.key

  CLI Example:

      salt '*' tls.create_ca test_ca

`salt.modules.tls.` `create_ca_signed_cert`(ca_name, CN, days=365)

  Create a Certificate (CERT) signed by a named Certificate Authority (CA)

  ca_name
    name of the CA
  CN
    common name matching the certificate signing request
  days
    number of days certificate is valid, default is 365 (1 year)

  Writes out a Certificate (CERT) If the file already exists, the function just returns assuming the CERT already exists.

  The CN must match an existing CSR generated by create_csr. If it does not, this method does nothing.

  If the following values were set:

      ca.cert_base_path='/etc/pki'
      ca_name='koji'
      CN='test.egavas.org'

  the resulting signed certificate would be written in the following location:

      /etc/pki/koji/certs/test.egavas.org.crt

  CLI Example:

      salt '*' tls.create_ca_signed_cert test localhost

`salt.modules.tls.` `create_csr`(ca_name, bits=2048, CN='localhost', C='US', ST='Utah', L='Salt Lake City', O='SaltStack', OU=None, emailAddress='xyz@pdq.net')

  Create a Certificate Signing Request (CSR) for a particular Certificate Authority (CA)

  ca_name
    name of the CA
  bits
    number of RSA key bits, default is 2048
  CN
    common name in the request, default is "localhost"
  C
    country, default is "US"
  ST
    state, default is "Utah"
  L
    locality, default is "Centerville", the city where SaltStack originated
  O
    organization, default is "SaltStack" NOTE: Must the same as CA certificate or an error will be raised
  OU
    organizational unit, default is None
  emailAddress
    email address for the request, default is 'xyz@pdq.net'

  Writes out a Certificate Signing Request (CSR) If the file already exists, the function just returns assuming the CSR already exists.

  If the following values were set:

      ca.cert_base_path='/etc/pki'
      ca_name='koji'
      CN='test.egavas.org'

  the resulting CSR, and corresponding key, would be written in the following location:

      /etc/pki/koji/certs/test.egavas.org.csr
      /etc/pki/koji/certs/test.egavas.org.key

  CLI Example:

      salt '*' tls.create_csr test

`salt.modules.tls.` `create_pkcs12`(ca_name, CN, passphrase='')

  Create a PKCS#12 browser certificate for a particular Certificate (CN)

  ca_name
    name of the CA
  CN
    common name matching the certificate signing request
  passphrase
    used to unlock the PKCS#12 certificate when loaded into the browser

  If the following values were set:

      ca.cert_base_path='/etc/pki'
      ca_name='koji'
      CN='test.egavas.org'

  the resulting signed certificate would be written in the following location:

      /etc/pki/koji/certs/test.egavas.org.p12

  CLI Example:

      salt '*' tls.create_pkcs12 test localhost

`salt.modules.tls.` `create_self_signed_cert`(tls_dir='tls', bits=2048, days=365, CN='localhost', C='US', ST='Utah', L='Salt Lake City', O='SaltStack', OU=None, emailAddress='xyz@pdq.net')

  Create a Self-Signed Certificate (CERT)

  tls_dir
    location appended to the ca.cert_base_path, default is 'tls'
  bits
    number of RSA key bits, default is 2048
  CN
    common name in the request, default is "localhost"
  C
    country, default is "US"
  ST
    state, default is "Utah"
  L
    locality, default is "Centerville", the city where SaltStack originated
  O
    organization, default is "SaltStack" NOTE: Must the same as CA certificate or an error will be raised
  OU
    organizational unit, default is None
  emailAddress
    email address for the request, default is 'xyz@pdq.net'

  Writes out a Self-Signed Certificate (CERT). If the file already exists, the function just returns.

  If the following values were set:

      ca.cert_base_path='/etc/pki'
      tls_dir='koji'
      CN='test.egavas.org'

  the resulting CERT, and corresponding key, would be written in the following location:

      /etc/pki/koji/certs/test.egavas.org.crt
      /etc/pki/koji/certs/test.egavas.org.key

  CLI Example:

      salt '*' tls.create_self_signed_cert

Current Salt release: 0.17.1

#### Previous topic

salt.modules.timezone

#### Next topic

salt.modules.tomcat

### Quick search

Enter search terms or a module, class or function name.

### Upcoming SaltStack Events

My conferences on Lanyrd