Puppet

Hi,

it seems that 0.25.x SSL is broken when using a chained CA.

I’m attaching a simple script (and output) showing that using simple net/https works, while using puppet internally does not.

it doesn’t seems to be related to the SSL initialization itself, rather to something else

h2. example script

require 'net/https'
require 'puppet/network/http_pool'

args = ["puppet", 8140]
header = { "Accept" => "pson" }
url = "/development/file_content/facts/somefact.rb"


http = Puppet::Network::HttpPool.http_instance(*args)
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
begin
  puts http.get url, header
rescue 
 warn $!
end

Puppet[:config] = "/etc/puppet/puppet.conf"
Puppet.parse_config
http = Net::HTTP.new(*args)
http.use_ssl = true
http.cert_store = OpenSSL::X509::Store.new
http.key = OpenSSL::PKey::RSA.new(File::read(Puppet[:hostprivkey]))
http.cert = OpenSSL::X509::Certificate.new(File::read(Puppet[:hostcert]))
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
http.ca_file = Puppet[:localcacert]

puts http.get url, header

h2. output

SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed
#
"#"