certificate-authority: {
    # allow CA to sign certificate requests that have subject alternative names.
    # allow-subject-alt-names: false

    # allow CA to sign certificate requests that have authorization extensions.
    # allow-authorization-extensions: false

    # enable the separate CRL for Puppet infrastructure nodes
    # enable-infra-crl: false
    # Disable auto renewal of certs by default.
    allow-auto-renewal: false
    # This value determines the lifetime of the cert if auto-renewal is enabled
    auto-renewal-cert-ttl: "60d"
    # Default cert expiration time. If the value is set here, it will take precedence over ca-ttl setting in puppet.conf
    #ca-ttl: "60d"
}
