CA passphrase and encryption

When using database-backed CA storage:

  • CA private keys are stored in the database

  • Keys are encrypted at rest

  • A passphrase file is used to decrypt them

Passphrase file

Default location:

/etc/puppetlabs/puppetserver/ca/.private-key-passphrase

Properties:

  • Owner: pe-puppet

  • Group: pe-puppet

  • Permissions: 0600 (read and write access for the owner only)

Creation

  • The passphrase file is automatically created during the first migration

  • It contains a generated encryption key

High availability

In HA deployments:

  • The passphrase file is automatically replicated to replica nodes

  • It is available during failover

The passphrase file is required to decrypt Certificate Authority private keys stored in the database. If the passphrase is lost and cannot be restored from backup, the CA cannot be recovered and must be rebuilt. New PE 2026.x installations use database-backed CA storage by default. Store backups of the passphrase securely and ensure they are available as part of your disaster recovery plan.

Rotate the passphrase

To rotate:

puppetserver ca storage --rotate-passphrase