|
This ticket is a result of PUP-7482.
Puppet does not allow callers to specify which CA certs should be trusted when making SSL connections (see PUP-5069). As a result, there are three places where we create SSL connections, and configure the X509::Store:
1. puppet/network/http/factory
|
2. puppet/util/http_proxy
|
3. puppet/forge/repository
|
There are several inconsistencies as a result:
1. persistent connections are used for 1, but not 2 2. We send "Ruby" as the user-agent for 2 3. We don't send the X-PUPPET-VERSION header for 2 4. 1 and 2 handle proxy settings differently.
|