Allow Puppet::HTTP::Client to connect to a server requiring client cert authentication and whose server cert is issued by a CA in the 'ssl_trust_store'

Puppet Version: 6.27.0 and 7.16.0
Puppet Server Version: N/A
OS Name/Version: Any

PUP-11471 enabled using the system CA store when using HTTP::Client, however, it did not enable users to use the 'ssl_trust_store' Puppet.conf option with client SSL authentication. After PUP-11471 a user can use 'create_context' or 'load_context' to use client based authentication with 'include_system_store: true' to load the trusted CA certificates from '/opt/puppetlabs/puppet/ssl/certs/' and '/opt/puppetlabs/puppet/ssl/cert.pem'. It does not enable a user to use 'create_context' or 'load_context' to use client based authentication with 'include_system_store: true' to load the trusted CA certificates from the 'ssl_trust_store' Puppet.conf option.

The 'ssl_trust_store' Puppet.conf option removes the requirement of using 'c_rehash' or appending the CA bundle to '/opt/puppetlabs/puppet/ssl/cert.pem', which is overwritten on any agent upgrade.

When 'include_system_store: true' is passed, 'create_context' should load 'Puppet[:ssl_trust_store]' the same way that 'create_system_context` does here: https://github.com/puppetlabs/puppet/blob/d894861565aa95bd6f4f1cb85fe44ab62cc37854/lib/puppet/ssl/ssl_provider.rb#L73-L89

Desired Behavior:

'create_context' should load the certificates from 'Puppet[:ssl_trust_store]' with 'include_system_store: true'.

Actual Behavior:
There is no way to load the certificates from 'Puppet[:ssl_trust_store]' with 'create_context'.

Using the system context is not an option in this scenario as it does not use the client certificates for authentication.

Examples:

We would expect the following to use client certificates and load the certificate bundles defined in 'Puppet[:ssl_trust_store]'. It does not work unless the CA certificate is loaded into /opt/puppetlabs/puppet/ssl/certs/ and /opt/puppetlabs/puppet/bin/c_rehash is run.

url = 'https://example.com/file.tar.gz' # server trusted by system trust store, and demanding a client certificate signed by the puppet CA

client = Puppet.runtime[:http]

provider = Puppet::SSL::SSLProvider.new

ssl_context = provider.load_context(revocation: false, include_system_store: true)

client.get(URI(url), options: { ssl_context: ssl_context }) do |response|

  raise 'Failed to download artifact' unless response.success?

  response.read_body { |data| do_something(data) }

end