certificate-authority: {
    # allow CA to sign certificate requests that have subject alternative names.
    allow-subject-alt-names: <%= @ca_allow_sans %>

    # allow CA to sign certificate requests that have authorization extensions.
    allow-authorization-extensions: <%= @ca_allow_auth_extensions %>

    # enable the separate CRL for Puppet infrastructure nodes
    enable-infra-crl: <%= @ca_enable_infra_crl %>
}
