puppet-reap

# Variables
CERTS=''
PUPPET=/opt/puppetlabs/bin/puppet
CERTFILES=/etc/puppetlabs/puppet/ssl/ca/signed
PREFIX=<%= @prefix %>

# Logic

CERTS=$(${PUPPET} cert list --all | grep -e "^\+\s\"${PREFIX}.*$" | cut -f 2 -d ' ' | sed 's/\"//g')
echo "Found $(echo ${CERTS} | wc -w) ephemeral clone certificates."

# Loop through the found certificates
for cert in ${CERTS}; do
  LOOKUP=$(nslookup ${cert})

  # If it doesn't exist, purge it
  if [ $? -eq 0 ] ; then
    echo "${cert} is online."
  else
    echo "${cert} offline.  Purging..."
    echo "Removing ${CERTFILES}/${cert}.pem..."
    rm ${CERTFILES}/${cert}.pem
  fi
done