Jira (PUP-11471) Allow Puppet::HTTP::Client to connect to server trusted by the system trust store using the puppet certificate for client authentification

[Romain Tartière]

Title: Message Title

Romain Tartière created an issue   Puppet / PUP-11471 Allow Puppet::HTTP::Client to connect to server trusted by the system trust store using the puppet certificate for client authentification Issue Type: Improvement Assignee: Unassigned Created: 2022/02/26 7:53 PM Priority: Normal Reporter: Romain Tartière On instantiation, a Puppet::HTTP::Client use a Puppet::SSL::Context to verify secure connections to remote hosts.  The Puppet::SSL::Provider provide convenience methods to build SSL Contexts: create_insecure_context: An insecure SSL Context, allowing connections to any host without client certificate authentication; create_root_context: A basic SSL Context trusting the passed certificates and that does not allow client certificate authentication; create_system_context: A basic SSL Context trusting system certificates but not checking CRL and not allowing client certificate authentication; create_context: A SSL Context suitable for communication with puppet trusting only the puppet CA, checking CRL and using client certificate authentication. None of these SSL Context allow to download files served by a server using certificates signed by a trusted third-party (system store) but with client certificate authentication.  We use this scheme to distribute files to our puppet nodes from servers which use standard TSL certificates provided by Let's Encrypt: the certificate is trusted in the system store, but we also require a client certificate signed by our Puppet CA for the client to download files. This issue is about making it possible for the base Puppet HTTP Client to generate a SSL Context suitable for this kind of usages.   Add Comment   This message was sent by Atlassian Jira (v8.20.2#820002-sha1:829506d) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.437493.1645934037000.24699.1645934040051%40Atlassian.JIRA.