Jira (PUP-7814) HTTPS file sources with non-puppet-trusted certs can't be used

[Charlie Sharpsteen (JIRA)]

Title: Message Title

Charlie Sharpsteen commented on PUP-7814   Re: HTTPS file sources with non-puppet-trusted certs can't be used It's not quite clear from the description, but this also affects HTTPS urls that are from servers that use certificates issued by the Puppet CA. The only CAs that are trusted are those in the CA bundle in the puppet-agent package: /opt/puppetlabs/puppet/ssl/cert.pem A simple re-production is to use a HTTPS source to download a copy of the Puppet CA cert from the Puppet Server: cat <<'EOF' > /etc/puppetlabs/code/environments/production/manifests/site.pp node default { file { '/tmp/ca.pem': ensure => file, source => "https://${server_facts['servername']}:8140//puppet-ca/v1/certificate/ca?environment=production", } } EOF This fails on Puppet 6 with: # puppet agent -t Info: Using configured environment 'production' Info: Retrieving pluginfacts Info: Retrieving plugin Info: Retrieving locales Info: Caching catalog for jvsf81owg61pufd.delivery.puppetlabs.net Info: Applying configuration version '1561753379' Error: /Stage[main]/Main/Node[default]/File[/tmp/ca.pem]: Could not evaluate: Could not retrieve file metadata for https://jvsf81owg61pufd.delivery.puppetlabs.net:8140/puppet-ca/v1/certificate/ca?environment=production: SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate) Notice: Applied catalog in 0.07 seconds And on Puppet 5 with: # puppet agent -t Info: Using configured environment 'production' Info: Retrieving pluginfacts Info: Retrieving plugin Info: Retrieving locales Info: Caching catalog for vwirqi7pylvyl6b.delivery.puppetlabs.net Info: Applying configuration version '1561753402' Error: /Stage[main]/Main/Node[default]/File[/tmp/ca.pem]: Could not evaluate: Could not retrieve file metadata for https://vwirqi7pylvyl6b.delivery.puppetlabs.net:8140/puppet-ca/v1/certificate/ca?environment=production: SSL_connect returned=1 errno=0 state=error: certificate verify failed Notice: Applied catalog in 0.05 seconds Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.203766.1501710671000.1075.1561753680466%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.