Database-backed certificate authority

Puppet Enterprise can store certificate authority (CA) data in a PostgreSQL database (pe-ca) instead of the file system ($cadir).

  • PE 2025.x: Database-backed CA storage is optional

  • PE 2026.x and later: Database-backed storage is the default

For new PE 2026.x installations, database-backed CA storage is enabled by default. Upgrades from earlier releases retain their existing CA storage backend configuration.

This improves:

  • Performance, by reducing file system contention

  • Reliability, by removing dependency on file locking and disk I/O

  • Scalability, by centralizing CA state

puppetserver ca storage is not the same as puppetserver ca migrate. The ca migrate command is a legacy upgrade tool and is not used for database-backed CA storage.

How it works

  • CA data is stored in the pe-ca PostgreSQL database

  • The CA service continues to use the same APIs and workflows

  • The storage backend is controlled by the puppet_enterprise::ca_storage_backend parameter

On PE 2025.x installations, the database remains unused until database-backed CA storage is enabled. On new PE 2026.x installations, database-backed CA storage is enabled by default.

Next steps