Back up and restore a database-backed CA

No changes are required to your backup process.

Puppet Enterprise automatically backs up:

  • CA database (pe-ca)

  • Passphrase file and CA configuration

Backup behavior

  • Database-backed CA data is stored in the pe-ca database

  • Private keys are encrypted at rest

  • The passphrase file is included in file system backups

Restore behavior

During restore:

  1. The passphrase file is restored.

  2. The database is restored.

This ensures encrypted keys can be decrypted correctly.

Restore compatibility

You cannot restore a backup taken from a database-backed CA onto a system using file system-backed storage.

To restore:

  1. Migrate the target system to database-backed storage.

  2. Re-run the restore.

External PostgreSQL

If you are using external PostgreSQL:

  • Database restore must be performed manually using your database provider

  • File system data (including the passphrase) is still restored by PE