Add a renew_cert subcommand to puppet ssl

[jay7x]

TODO:

• Add unit test
• Test it in reality

[ekohl]

I like the idea. Thoughts:

• Should it be just puppet ssl renew?
• Should it look at the expiration date and only renew if it's at X% towards its expiration?
• If the above is implemented, should it have a --force option to force a renewal?

[jay7x]

• Should it be just puppet ssl renew?

That was my original idea.. But then I decided to follow what we already have (download_cert e.g.). I'm fine to rename back.

• Should it look at the expiration date and only renew if it's at X% towards its expiration?

Ideally, yes.

• If the above is implemented, should it have a --force option to force a renewal?

There should be one more option then. It should be possible to say "please renew the certificate if it'll expire in this amount of days". Not sure how to call that.. --if-expiring-in-days? --expiry-days?

I'm not sure if having a "please renew the certificate if it's about X% expired" option is really useful. Usually people think in days.. This option exists in vaultbot IIRC, but I never used it. Any opinions?

[jay7x]

Tested it against my puppetserver:

# puppet ssl submit_request --certname puppet2.example.com  --hostcert_renewal_interval 60d --waitforcert 0
Notice: Submitted certificate request for 'puppet2.example.com' to https://puppetca.tld:8140/puppet-ca/v1
Notice: Downloaded certificate 'puppet2.example.com' with fingerprint (SHA256) 67:A4:95:E9:2B:24:71:58:28:B5:D8:07:21:4C:2B:6B:2E:EA:11:52:22:CF:AE:9A:05:A5:2C:88:38:28:41:12
# puppet ssl renew_cert --certname puppet2.example.com
Notice: Downloaded certificate 'puppet2.example.com' with fingerprint (SHA256) 27:2A:89:FC:67:40:56:1A:C5:2B:5E:90:6C:37:68:D8:01:DE:DF:F8:FD:97:C4:66:A5:E2:EA:BF:41:42:19:97
# puppet ssl renew_cert --certname puppet2.example.com --if-expiring-in 30d
# puppet ssl renew_cert --certname puppet2.example.com --if-expiring-in 90d
Notice: Downloaded certificate 'puppet2.example.com' with fingerprint (SHA256) 1B:7D:21:62:41:67:8E:8C:37:F0:EC:EF:D0:0A:3C:E1:B3:A7:A5:6D:7C:16:90:EC:39:89:12:60:3D:39:7B:34