Jira (PUP-11522) Allow Puppet::HTTP::Client to connect to a server the puppet certificate for client authentication and 'ssl_trust_store'

[Jarret Lavallee (Jira)]

Title: Message Title

Jarret Lavallee created an issue   Puppet / PUP-11522 Allow Puppet::HTTP::Client to connect to a server the puppet certificate for client authentication and 'ssl_trust_store' Issue Type: Bug Affects Versions: PUP 6.27.0, PUP 7.16.0 Assignee: Unassigned Created: 2022/04/26 11:12 AM Priority: Normal Reporter: Jarret Lavallee Puppet Version: 6.27.0 and 7.16.0 Puppet Server Version: N/A OS Name/Version: Any PUP-11471 enabled using the system CA store when using HTTP::Client, however, it did not enable users to use the 'ssl_trust_store' Puppet.conf option with client SSL authentication. After PUP-11471 a user can use 'create_context' or 'load_context' to use client based authentication with 'include_system_store: true' to load the trusted CA certificates from '/opt/puppetlabs/puppet/ssl/certs/' and '/opt/puppetlabs/puppet/ssl/cert.pem'. It does not enable a user to use 'create_context' or 'load_context' to use client based authentication with 'include_system_store: true' to load the trusted CA certificates from the 'ssl_trust_store' Puppet.conf option. The 'ssl_trust_store' Puppet.conf option removes the requirement of using 'c_rehash' or appending the CA bundle to '/opt/puppetlabs/puppet/ssl/cert.pem', which is overwritten on any agent upgrade. When 'include_system_store: true' is passed, 'create_context' should load 'Puppet[:ssl_trust_store]' the same way that 'create_system_context` does here: https://github.com/puppetlabs/puppet/blob/d894861565aa95bd6f4f1cb85fe44ab62cc37854/lib/puppet/ssl/ssl_provider.rb#L73-L89 Desired Behavior: 'create_context' should load the certificates from 'Puppet[:ssl_trust_store]' with 'include_system_store: true'. Actual Behavior: There is no way to load the certificates from 'Puppet[:ssl_trust_store]' with 'create_context'. Using the system context is not an option in this scenario as it does not use the client certificates for authentication. Examples: We would expect the following to use client certificates and load the certificate bundles defined in 'Puppet[:ssl_trust_store]'. It does not work unless the CA certificate is loaded into /opt/puppetlabs/puppet/ssl/certs/ and /opt/puppetlabs/puppet/bin/c_rehash is run. url = '' # server trusted by system trust store, and demanding a client certificate signed by the puppet CA client = Puppet.runtime[:http] provider = Puppet::SSL::SSLProvider.new ssl_context = provider.load_context(revocation: false, include_system_store: true) client.get(URI(url), options: { ssl_context: ssl_context }) do |response| raise 'Failed to download artifact' unless response.success?   response.read_body { |data| do_something(data) } end Add Comment   This message was sent by Atlassian Jira (v8.20.2#820002-sha1:829506d) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.444827.1650996743000.18054.1650996780084%40Atlassian.JIRA.