Jira (PUP-11471) Allow Puppet::HTTP::Client to connect to server trusted by the system trust store using the puppet certificate for client authentification

43 views
Skip to first unread message

Romain Tartière

unread,
Feb 26, 2022, 10:54:05 PM2/26/22
to puppe...@googlegroups.com
Romain Tartière created an issue
 
Puppet / Improvement PUP-11471
Allow Puppet::HTTP::Client to connect to server trusted by the system trust store using the puppet certificate for client authentification
Issue Type: Improvement Improvement
Assignee: Unassigned
Created: 2022/02/26 7:53 PM
Priority: Normal Normal
Reporter: Romain Tartière

On instantiation, a Puppet::HTTP::Client use a Puppet::SSL::Context to verify secure connections to remote hosts.  The Puppet::SSL::Provider provide convenience methods to build SSL Contexts:

  1. create_insecure_context: An insecure SSL Context, allowing connections to any host without client certificate authentication;
  2. create_root_context: A basic SSL Context trusting the passed certificates and that does not allow client certificate authentication;
  1. create_system_context: A basic SSL Context trusting system certificates but not checking CRL and not allowing client certificate authentication;
  1. create_context: A SSL Context suitable for communication with puppet trusting only the puppet CA, checking CRL and using client certificate authentication.

None of these SSL Context allow to download files served by a server using certificates signed by a trusted third-party (system store) but with client certificate authentication.  We use this scheme to distribute files to our puppet nodes from servers which use standard TSL certificates provided by Let's Encrypt: the certificate is trusted in the system store, but we also require a client certificate signed by our Puppet CA for the client to download files.

This issue is about making it possible for the base Puppet HTTP Client to generate a SSL Context suitable for this kind of usages.

 
Add Comment Add Comment
 
This message was sent by Atlassian Jira (v8.20.2#820002-sha1:829506d)
Atlassian logo

Romain Tartière

unread,
Feb 26, 2022, 10:57:03 PM2/26/22
to puppe...@googlegroups.com
Romain Tartière updated an issue
Change By: Romain Tartière
Acceptance Criteria: The following code works:

 {{{} url = '[https://example.com/file.tar.gz'] # server trusted by system trust store, and demanding a client certificate signed by the puppet CAclient CA{}}}{{{}client = Puppet.runtime[:http] {}}}{{{}provider = Puppet::SSL::SSLProvider.new{}}}{{{} client.get(URI(url), options: \ { ssl_context: ssl_context provider.create_XXX_context }) do |response| {}}}{{  raise 'Failed to download artifact' unless response.success?}}
{{{}  response.read_body \{ |data| do_something(data) }{}}}{{{}end{}}}

Romain Tartière

unread,
Feb 26, 2022, 10:58:03 PM2/26/22
to puppe...@googlegroups.com
Romain Tartière updated an issue
Change By: Romain Tartière
Acceptance Criteria: The following code works:

{{{}url = '[https://example.com/file.tar.gz'] # server trusted by system trust store, and demanding a client certificate signed by the puppet CA{}}}{{{}client = Puppet.runtime[:http]{}}}

{{{}provider = Puppet::SSL::SSLProvider.new{}}}{ \ {{}client.get(URI(url), options:

{ ssl_context: provider.create_XXX_context }

) do |response|{}}}{{  raise 'Failed to download artifact' unless response.success?}}
{{{}  response.read_body \{ |data| do_something(data) }{ { }}} } {{{}end{}}}

Romain Tartière

unread,
Feb 26, 2022, 11:00:04 PM2/26/22
to puppe...@googlegroups.com
Romain Tartière updated an issue
Change By: Romain Tartière
Acceptance Criteria: The following code works:
{ {{ code:java }
url = ' [ https://example.com/file.tar.gz' ] # server trusted by system trust store, and demanding a client certificate signed by the puppet CA {}}}{{{}
client = Puppet.runtime[:http] {}}}

{{{} provider = Puppet::SSL::SSLProvider.new {}}}{\{{}
client.get(URI(url), options:

{ ssl_context: provider.create_XXX_context }

) do |response| {}}}{{
  raise 'Failed to download artifact' unless response.success? }}
{{{}
  response.read_body \ { |data| do_something(data) } {{}}}}{{{}
end{ code } }}

Romain Tartière

unread,
Feb 26, 2022, 11:00:04 PM2/26/22
to puppe...@googlegroups.com
Romain Tartière updated an issue
On instantiation, a {{Puppet::HTTP::Client}} use a {{Puppet::SSL::Context}} to verify secure connections to remote hosts.  The {{Puppet::SSL::Provider}} provide convenience methods to build SSL Contexts:
# create_insecure_context: An insecure SSL Context, allowing connections to any host without client certificate authentication;
# create_root_context: A basic SSL Context trusting the passed certificates and that does not allow client certificate authentication;
# create_system_context: A basic SSL Context trusting system certificates but not checking CRL and not allowing client certificate authentication;
# create_context: A SSL Context suitable for communication with puppet trusting only the puppet CA, checking CRL and using client certificate authentication.


 None of these SSL Context allow to download files served by a server using certificates signed by a trusted third-party (system store) but with client certificate authentication.  We use this scheme to distribute files to our puppet nodes from servers which use standard TSL certificates provided by Let's Encrypt: the certificate is trusted in the system store, but we also require a client certificate signed by our Puppet CA for the client to download files.

This issue is about making it possible for the base Puppet HTTP Client to generate a SSL Context suitable for this kind of usages.

 

Romain Tartière

unread,
Feb 26, 2022, 11:05:03 PM2/26/22
to puppe...@googlegroups.com
Romain Tartière updated an issue
Change By: Romain Tartière
Acceptance Criteria:
The following code works:
{code:java}
url = 'https://example.com/file.tar.gz' # server trusted by system trust store, and demanding a client certificate signed by the puppet CA

client = Puppet.runtime[:http]
provider = Puppet::SSL::SSLProvider.new
client.get(URI(url), options: { ssl_context: provider. create_XXX_context create_hybrid_context }) do |response|

 raise 'Failed to download artifact' unless response.success?

 response.read_body { |data| do_something(data) }
end{code}

Romain Tartière

unread,
Feb 27, 2022, 1:29:03 AM2/27/22
to puppe...@googlegroups.com
Romain Tartière updated an issue
On instantiation, a {{Puppet::HTTP::Client}} use a {{Puppet::SSL::Context}} to verify secure connections to remote hosts.  The {{Puppet::SSL::Provider}} provide convenience methods to build SSL Contexts:
# create_insecure_context: An insecure SSL Context, allowing connections to any host without client certificate authentication;
# create_root_context: A basic SSL Context trusting the passed certificates and that does not allow client certificate authentication;
# create_system_context: A basic SSL Context trusting system certificates but not checking CRL and not allowing client certificate authentication;
# create_context: A SSL Context suitable for communication with puppet trusting only the puppet CA, checking CRL and using client certificate authentication.

None of these SSL Context allow to download files served by a server using certificates signed by a trusted third-party (system store) but with client certificate authentication.  We use this scheme to distribute files to our puppet nodes from servers which use standard TSL TLS certificates provided by Let's Encrypt: the certificate is trusted in the system store, but we also require a client certificate signed by our Puppet CA for the client to download files (our rationale is we want to use "standard" certificates to allow access to the files with either login+password or a trusted client certificate, and the code being used by Bolt, it is convenient to rely on Puppet::HTTP::Client to download these files) .


This issue is about making it possible for the base Puppet HTTP Client to generate a SSL Context suitable for this kind of usages.

 

Romain Tartière

unread,
Feb 28, 2022, 3:36:02 PM2/28/22
to puppe...@googlegroups.com
Romain Tartière updated an issue
On instantiation, a {{Puppet::HTTP::Client}} use a {{Puppet::SSL::Context}} to verify secure connections to remote hosts.  The {{Puppet::SSL::Provider}} provide convenience methods to build SSL Contexts:
# create_insecure_context: An insecure SSL Context, allowing connections to any host without verification and not allowing client certificate authentication;

# create_root_context: A basic SSL Context trusting the passed certificates and that does not allow client certificate authentication;
# create_system_context: A basic SSL Context trusting system certificates but not checking CRL and not allowing client certificate authentication;
# create_context: A SSL Context suitable for communication with puppet trusting only the puppet CA, checking CRL and using client certificate authentication.

None of these SSL Context allow to download files served by a server using certificates signed by a trusted third-party (system store) but with client certificate authentication.  We use this scheme to distribute files to our puppet nodes from servers which use standard TLS certificates provided by Let's Encrypt: the certificate is trusted in the system store, but we also require a client certificate signed by our Puppet CA for the client to download files (our rationale is we want to use "standard" certificates to allow access to the files with either login+password or a trusted client certificate, and the code being used by Bolt, it is convenient to rely on Puppet::HTTP::Client to download these files).


This issue is about making it possible for the base Puppet HTTP Client to generate a SSL Context suitable for this kind of usages.

 

Romain Tartière

unread,
Feb 28, 2022, 3:36:02 PM2/28/22
to puppe...@googlegroups.com
Romain Tartière updated an issue
On instantiation, a {{Puppet::HTTP::Client}} use a {{Puppet::SSL::Context}} to verify secure connections to remote hosts.  The {{Puppet::SSL::Provider}} provide convenience methods to build SSL Contexts:
# create_insecure_context: An insecure SSL Context, allowing connections to any host without verification and not allowing client certificate authentication;
# create_root_context: A basic SSL Context trusting the passed certificates and that does not allow client certificate authentication;
# create_system_context: A basic SSL Context trusting system certificates but not checking CRL (because they do not exist) and not allowing client certificate authentication;

# create_context: A SSL Context suitable for communication with puppet trusting only the puppet CA, checking CRL and using client certificate authentication.

None of these SSL Context allow to download files served by a server using certificates signed by a trusted third-party (system store) but with client certificate authentication.  We use this scheme to distribute files to our puppet nodes from servers which use standard TLS certificates provided by Let's Encrypt: the certificate is trusted in the system store, but we also require a client certificate signed by our Puppet CA for the client to download files (our rationale is we want to use "standard" certificates to allow access to the files with either login+password or a trusted client certificate, and the code being used by Bolt, it is convenient to rely on Puppet::HTTP::Client to download these files).

This issue is about making it possible for the base Puppet HTTP Client to generate a SSL Context suitable for this kind of usages.

 

Romain Tartière

unread,
Feb 28, 2022, 3:38:02 PM2/28/22
to puppe...@googlegroups.com
This issue is about making it possible for the base Puppet HTTP Client to generate a SSL Context suitable for this kind of usages :
# Verify remote host against system trusted CA;
# Do not enforce CRL check because there is none for the system trust store;
# Authenticate using puppet node certificate .

 

Nirupama Mantha (Jira)

unread,
Mar 1, 2022, 4:18:03 PM3/1/22
to puppe...@googlegroups.com
Nirupama Mantha updated an issue
Change By: Nirupama Mantha
Team: Phoenix

Nirupama Mantha (Jira)

unread,
Mar 1, 2022, 4:19:03 PM3/1/22
to puppe...@googlegroups.com
Nirupama Mantha updated an issue
Change By: Nirupama Mantha
Story Points: 1

Lisa Ross (Jira)

unread,
Mar 10, 2022, 11:49:02 AM3/10/22
to puppe...@googlegroups.com
Lisa Ross updated an issue
Change By: Lisa Ross
Community Contributors: smortex

Lisa Ross (Jira)

unread,
Mar 10, 2022, 11:52:01 AM3/10/22
to puppe...@googlegroups.com
Lisa Ross updated an issue
Change By: Lisa Ross
Fix Version/s: PUP 6.27.0

Lisa Ross (Jira)

unread,
Mar 10, 2022, 11:56:02 AM3/10/22
to puppe...@googlegroups.com
Lisa Ross updated an issue
Change By: Lisa Ross
Sprint: Phoenix 2022-03-30

Josh Cooper (Jira)

unread,
Mar 14, 2022, 12:55:02 PM3/14/22
to puppe...@googlegroups.com
Josh Cooper updated an issue
Change By: Josh Cooper
Fix Version/s: PUP 7.16.0

Josh Cooper (Jira)

unread,
Mar 18, 2022, 12:58:02 PM3/18/22
to puppe...@googlegroups.com
Josh Cooper updated an issue
Change By: Josh Cooper
Release Notes: Enhancement
Release Notes Summary: It's now possible to connect to "https" file sources that require a client certificate for authentication.

Josh Cooper (Jira)

unread,
Mar 18, 2022, 1:04:01 PM3/18/22
to puppe...@googlegroups.com
Josh Cooper updated an issue
Change By: Josh Cooper
Release Notes Summary: It's You can now possible to connect to specify an "https" URL as the "source" of a " file sources that require " resource when the TLS server requires a client certificate for authentication.

Nirupama Mantha (Jira)

unread,
Mar 30, 2022, 11:18:02 AM3/30/22
to puppe...@googlegroups.com
Nirupama Mantha updated an issue
Change By: Nirupama Mantha
Sprint: Phoenix 2022-03-30 , Phoenix 2022-04-13

Josh Cooper (Jira)

unread,
Mar 31, 2022, 11:54:02 PM3/31/22
to puppe...@googlegroups.com

Parker Leach (Jira)

unread,
Apr 8, 2022, 2:13:02 PM4/8/22
to puppe...@googlegroups.com
Parker Leach updated an issue
 
Change By: Parker Leach
Labels: docs_reviewed

Josh Cooper (Jira)

unread,
Apr 21, 2022, 12:23:01 PM4/21/22
to puppe...@googlegroups.com
Josh Cooper updated an issue
Change By: Josh Cooper
Acceptance Criteria:
The following code works:
{code:java}url = 'https://example.com/file.tar.gz' # server trusted by system trust store, and demanding a client certificate signed by the puppet CA
client = Puppet.runtime[:http]
 provider = Puppet::SSL::SSLProvider.new
client.get(URI(url), options: { ssl_context include_system_store : provider.create_hybrid_context true }) do |response|

 raise 'Failed to download artifact' unless response.success?

 response.read_body { |data| do_something(data) }
end{code}

Alvin Rodis (Jira)

unread,
Apr 25, 2022, 9:50:02 AM4/25/22
to puppe...@googlegroups.com
Alvin Rodis updated an issue
Change By: Alvin Rodis
Labels: docs_reviewed jira_escalated

Alvin Rodis (Jira)

unread,
Apr 25, 2022, 9:50:02 AM4/25/22
to puppe...@googlegroups.com
Alvin Rodis updated an issue
Change By: Alvin Rodis
Zendesk Ticket Count: 1
Zendesk Ticket IDs: 48141
Reply all
Reply to author
Forward
0 new messages