Short names for cert extension OIDs
custom_trusted_oid_mapping.yaml file lets you set your own short
names for certificate extension object identifiers (OIDs), which can make the
$trusted variable more
It is only valid on a primary Puppet server. In Puppet apply, the compiler doesn’t add certificate extensions
When a node requests a certificate, it can ask the CA to include some additional, permanent
metadata in that cert. Puppet agent uses the
csr_attributes.yaml file to decide what extensions to request.
If the CA signs a certificate with extensions included, those extensions are available
as trusted facts in the top-scope
$trusted variable. Your manifests or node classifier can then use those
trusted facts to decide which nodes can receive which configurations.
By default, the
Puppet-specific registered OIDs appear as keys
with convenient short names in the
$trusted[extensions] hash, and any other OIDs appear as raw numerical IDs.
You can use the
custom_trusted_oid_mapping.yaml file to map other OIDs to short names, which
replaces the numerical OIDs in
puppetserver ca print to see changes made in
custom_trusted_oid_mapping.yaml immediately without a
For more information, see CSR attributes and certificate extensions, Trusted
Limitations of OID mapping
Mapping OIDs in this file only affects the keys in the
$trusted[extensions] hash. It does not affect what an agent
can request in its
csr_attributes.yaml file —
anything but Puppet-specific registered extensions must still
be numerical OIDs.
After setting custom OID mapping values and restarting puppetserver, you can reference variables using only the short name.
The OID mapping file is located at
$confdir/custom_trusted_oid_mapping.yaml by default. Its location is
configurable with the
The location of the
confdir depends on your
OS. See the confdir
documentation for details.
--- oid_mapping: 18.104.22.168.4.1.34322.214.171.124.1: shortname: 'myshortname' longname: 'My Long Name' 126.96.36.199.4.1.343188.8.131.52.2: shortname: 'myothershortname' longname: 'My Other Long Name'
custom_trusted_oid_mapping.yaml must be a
YAML hash containing a single key called
The value of the
oid_mapping key must be a hash
whose keys are numerical OIDs. The value for each OID must be a hash with two keys:
shortnamefor the case-sensitive one-word name that is used in the
longnamefor a more descriptive name (not used elsewhere).