(PUP-10589) Add a generate_request option to puppet ssl

[joshcooper]

Adds a command puppet ssl generate_request to generate a CSR but not submit it. This is useful when boostrapping an offline agent.

[cthorn42]

@joshcooper is it expected that generate_request will overwrite a CSR if one is in place?

[joshcooper]

Is it expected that generate_request will overwrite a CSR if one is in place?

Yes good question. Short version is it's ok.

Long version is the agent only writes out the CSR as a temporary file

puppet/lib/puppet/ssl/state_machine.rb

Line 320 in 90720bd

@cert_provider.save_request(Puppet[:certname], csr)

Once a cert is issued and downloaded, the temporary CSR is deleted

puppet/lib/puppet/ssl/state_machine.rb

Line 347 in 90720bd

@cert_provider.delete_request(Puppet[:certname])

The cert request may take "awhile" to be approved, so each time the agent tries to get a cert, it generates a new CSR, sends to the CA, and writes the CSR to disk, overwriting the previous version.

Older versions of puppet (back when we used the indirector to bootstrap the agent) used to load the CSR from disk. If the keys were regenerated sometime after the CSR was written to, then they wouldn't be consistent and the agent had to be manually cleaned. We avoid those issues by only writing out the CSR, but never reading it back it.