4 files changed, 21 insertions, 2 deletions
diff --git a/lib/puppet/indirector/certificate/ca_file.rb b/lib/puppet/indirector/certificate/ca_file.rb
index 99941c49e..a7d901535 100644
--- a/lib/puppet/indirector/certificate/ca_file.rb
+++ b/lib/puppet/indirector/certificate/ca_file.rb
@@ -5,4 +5,5 @@ class Puppet::SSL::Certificate::CaFile < Puppet::Indirector::SslFile
     desc "Manage the CA collection of signed SSL certificates on disk."
 
     store_in :signeddir
+    store_ca_at :cacert
 end
diff --git a/lib/puppet/indirector/certificate/file.rb b/lib/puppet/indirector/certificate/file.rb
index 5f4ade051..9e2e8ed99 100644
--- a/lib/puppet/indirector/certificate/file.rb
+++ b/lib/puppet/indirector/certificate/file.rb
@@ -5,5 +5,4 @@ class Puppet::SSL::Certificate::File < Puppet::Indirector::SslFile
     desc "Manage SSL certificates on disk."
 
     store_in :certdir
-    store_ca_at :cacert
 end
diff --git a/lib/puppet/indirector/key/ca_file.rb b/lib/puppet/indirector/key/ca_file.rb
new file mode 100644
index 000000000..0193dea90
--- /dev/null
+++ b/lib/puppet/indirector/key/ca_file.rb
@@ -0,0 +1,20 @@
+require 'puppet/indirector/ssl_file'
+require 'puppet/ssl/key'
+
+class Puppet::SSL::Key::CaFile < Puppet::Indirector::SslFile
+    desc "Manage the CA's private on disk.  This terminus *only* works
+        with the CA key, because that's the only key that the CA ever interacts
+        with."
+
+    # This is just to pass the validation in the base class.  Eh.
+    store_at :cakey
+
+    store_ca_at :cakey
+
+    def path(name)
+        unless ca?(name)
+            raise ArgumentError, "The :ca_file terminus can only handle the CA private key"
+        end
+        super
+    end
+end
diff --git a/lib/puppet/indirector/key/file.rb b/lib/puppet/indirector/key/file.rb
index 4536f8aa7..7103c2903 100644
--- a/lib/puppet/indirector/key/file.rb
+++ b/lib/puppet/indirector/key/file.rb
@@ -5,7 +5,6 @@ class Puppet::SSL::Key::File < Puppet::Indirector::SslFile
     desc "Manage SSL private and public keys on disk."
 
     store_in :privatekeydir
-    store_ca_at :cakey
 
     # Where should we store the public key?
     def public_key_path(name)