Jira (PUP-7137) Support Using TPM-Backed SSL Private Keys for Puppet Agent

[Tray Torrance (JIRA)]

Title: Message Title

Tray Torrance created an issue   Puppet / PUP-7137 Support Using TPM-Backed SSL Private Keys for Puppet Agent Issue Type: Bug Assignee: Unassigned Created: 2017/01/26 5:11 PM Priority: Normal Reporter: Tray Torrance Today, the puppet agent requires its SSL private keys to be stored on disk, optionally encrypted with a password. On a system with a TPM, and the openssl TPM engine available, the ruby code to retrieve a private key from the TPM is incredibly simple: Load All Available Engines OpenSSL::Engine.load tpm = OpenSSL::Engine.by_id('tpm') key = tpm.load_private_key('/path/to/tss_blob.pem') {nformat} (Note that tss_blob.pem is the intermediate file generated by the supporting tools for the OpenSSL TPM engine) With a simple config flag, the Puppet agent could support loading the private key from the TPM (or, due to the Engine API, any arbitrary OpenSSL) engine. The above code would effectively replace a call to wrapped_class#new in Puppet::SSL::Key. Given the niche set of users this likely applies to, it would almost certainly be safe to assume (for now) that users of this feature are comfortable with initializing the TPM out-of-band, and installing the TSS blob at $ssldir/private_keys/$fqdn.pem, as well as installing the engine, etc. Add Comment   This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.