Jira (PUP-10144) Add SSLProvider#create_system

Josh Cooper (JIRA)

unread,

Nov 18, 2019, 6:07:03 PM11/18/19

to puppe...@googlegroups.com

Josh Cooper created an issue

Puppet /

PUP-10144

Add SSLProvider#create_system_context method

Issue Type:	Task
Assignee:	Unassigned
Created:	2019/11/18 3:06 PM
Priority:	Normal
Reporter:	Josh Cooper

Add a method to Puppet::SSL::SSLProvider for loading a system ssl context. This will be needed in order to retrieve file content from HTTPS servers whose certs are not signed by Puppet, but by well known CAs like VeriSign.

The method should require a cacerts argument containing an array of {{OpenSSL::X509::Certificate}}s. It's ok if the array is empty, but should raise ArgumentError if nil.

The method should return a Puppet::SSL::SSLContext:

The context's store should have VERIFY_PEER set
Each cacert should be added to the store.
The set_default_paths method should be called on the store.
Revocation should be disabled.
The private key and client cert should be nil

Add Comment

This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93)

Josh Cooper (JIRA)

unread,

Nov 18, 2019, 7:54:04 PM11/18/19

to puppe...@googlegroups.com

Josh Cooper assigned an issue to Josh Cooper

Puppet /

PUP-10144

Add SSLProvider#create_system_context method

Change By:	Josh Cooper
Assignee:	Josh Cooper

Add Comment

Josh Cooper (JIRA)

unread,

Nov 19, 2019, 12:30:04 PM11/19/19

to puppe...@googlegroups.com

Josh Cooper updated an issue

Puppet /

PUP-10144

Add SSLProvider#create_system_context method

Change By:	Josh Cooper
Sprint:	Platform Core KANBAN

Add Comment

Josh Cooper (JIRA)

unread,

Nov 19, 2019, 12:31:04 PM11/19/19

to puppe...@googlegroups.com

Josh Cooper updated an issue

Puppet /

PUP-10144

Add SSLProvider#create_system_context method

Change By:	Josh Cooper

Add a method to {{Puppet::SSL::SSLProvider}} for loading a system ssl context. This will be needed in order to retrieve file content from HTTPS servers whose certs are not signed by Puppet, but by well known CAs like VeriSign.

The method should require a {{cacerts}} argument containing an array of {{OpenSSL::X509::Certificate}} s . It's ok if the array is empty, but should raise ArgumentError if nil.

The method should return a {{Puppet::SSL::SSLContext}}:

* The context's store should have VERIFY_PEER set
* Each {{cacert}} should be added to the store.
* The {{set_default_paths}} method should be called on the store.
* Revocation should be disabled.
* The private key and client cert should be nil