I'm reading that the default expiry date for puppet certificates is 5 years, and can set set with the attribute ca_ttl in puppet.conf . I have 2 questions, given a setup of many agents connecting to a puppet master. What happens when an agents certificate expires? Does it automatically create a new one on check-in to the master, or does this need to be done manually? What happens when the CA certificate expires? Does the setup become completely disconnected, requiring you to SSH into each agent to remove expired certificates?

Puppet after 5 years, when certificates expire?

I'm reading that the default expiry date for puppet certificates is 5 years, and can set set with the attribute ca_ttl in puppet.conf.

I have 2 questions, given a setup of many agents connecting to a puppet master.

What happens when an agents certificate expires? Does it automatically create a new one on check-in to the master, or does this need to be done manually?
What happens when the CA certificate expires? Does the setup become completely disconnected, requiring you to SSH into each agent to remove expired certificates?