openssl x509 -x509toreq -in /etc/puppetlabs/puppet/ssl/ca/ca_crt.pem -signkey /etc/puppetlabs/puppet/ssl/ca/ca_key.pem -out ~/ca.csr