TLS

Generating a custom x509 certificate for an Okta app over the API, capturing the kid, and injecting it back into the app.

Renewing a Let's Encrypt certificate from cron with the webroot plugin, the matching nginx SSL block, and a stronger dhparam.

Foreman writes the autosign entry but the CSR sits pending forever, because permissions on the CA serial file reject the PUT.

Puppet exec resources that generate a Bacula client key and self-signed certificate, then concatenate them into the PEM the file daemon wants.