CA passphrase and encryption

When using database-backed CA storage:

  • CA private keys are stored in the database

  • Keys are encrypted at rest

  • A passphrase file is used to decrypt them

Passphrase file

Default location:

/etc/puppetlabs/puppetserver/ca/.private-key-passphrase

Properties:

  • Owner: pe-puppet

  • Group: pe-puppet

  • Permissions: 0600 (read and write access for the owner only)

Creation

  • The passphrase file is automatically created during the first migration

  • It contains a generated encryption key

High availability

In HA deployments:

  • The passphrase file is automatically replicated to replica nodes

  • It is available during failover

The passphrase file is required to decrypt CA private keys stored in the database. If the passphrase is lost and cannot be restored from backup, the CA cannot be recovered and must be rebuilt.

Rotate the passphrase

To rotate:

puppetserver ca storage --rotate-passphrase