Jira (PUP-11331) puppet-agent again unable to use https on masterless

[Josh Cooper (Jira)]

Title: Message Title

Josh Cooper commented on PUP-11331   Re: puppet-agent again unable to use https on masterless Puppet attempts to load the default SSLContext, because most of the time we need the client cert for mutual TLS authentication and we want to perform revocation checking (so we need CRLs). But to support this use case, it should be possible for the http processor (or a processor you write) to construct the SSL context directly using CA certs you provide: provider = Puppet::SSL::SSLProvider.new ssl_context = provider.create_system_context(cacerts: [], path: "/etc/ssl/certs/ca-certificates.crt")   http = Puppet.runtime[:http] http.post(url, data, ..., options: { ssl_context: ssl_context }) Note if you need more control over the ssl context, you can use Puppet::X509::CertProvider to load CA certs, and CRLs if want to perform revocation checking. We're unlikely to modify core puppet to support the case where client certs are not issued, but if you'd like to submit a PR to the "http" report processor that'd be great. We'd need a puppet setting like "report_something" that if set allows the "http" process to only trust the system store and disable client/cert & revocation logic. Add Comment   This message was sent by Atlassian Jira (v8.13.2#813002-sha1:c495a97) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.421530.1635509836000.166188.1635531420049%40Atlassian.JIRA.