Database-backed certificate authority

Puppet Enterprise can store certificate authority (CA) data in a PostgreSQL database (pe-ca) instead of the file system ($cadir).

  • PE 2025.x: Database-backed CA storage is optional

  • PE 2026.x and later: Database-backed storage is the default

This improves:

  • Performance, by reducing file system contention

  • Reliability, by removing dependency on file locking and disk I/O

  • Scalability, by centralizing CA state

puppetserver ca storage is not the same as puppetserver ca migrate. The ca migrate command is a legacy upgrade tool and is not used for database-backed CA storage.

How it works

  • CA data is stored in the pe-ca PostgreSQL database

  • The CA service continues to use the same APIs and workflows

  • The storage backend is controlled by the puppet_enterprise::ca_storage_backend parameter

The database is already provisioned on all PE 2025.x installations and remains unused until enabled.

Next steps