[PUP-8652] Agents should be able to use CA and CRL bundles - Puppet Jira Server

XML

Word

Printable

Details

Type: Story
Status: Closed
Priority: Normal
Resolution: Fixed
Affects Version/s: None
Fix Version/s: PUP 6.0.0
Component/s: None
Labels:
None

Acceptance Criteria:

Hide

Agents can verify the credentials of an intermediate Puppet CA

Show
Agents can verify the credentials of an intermediate Puppet CA
Epic Link:
Robust Intermediate CA
Team:
Froyo

Release Notes:
New Feature
Release Notes Summary:
Puppet Agent will now correctly save and load chained SSL certificates and certificate revocation lists when in an environment where its certs are issued by Puppet acting as an intermediate CA.

QA Risk Assessment:
Needs Assessment

Description

When I am using a Puppet CA set up as an intermediate CA, I need my agents to be able to verify the credentials of the master using the intermediate CA cert and CRL chain.

This entails being able to download bundled certs and CRLS, and process them correctly.

Attachments

Issue Links

relates to

PUP-1935 puppetd ignores local ca.pem when connecting to master for the first time

Closed

PUP-7295 Puppet is too permissive about skipping SSL verification

Closed

Sub-Tasks

1.	Agents should save all certs downloaded from the server	Closed	Maggie Dreyer
2.	Agents should save all CRLs downloaded from the server	Closed	Tony Vu
3.	Agent should use whole cert bundle to verify master's credentials	Resolved	Tony Vu
4.	Agents should use the CRL bundle to verify the revocation status of their master	Closed	Justin Stoller
5.	Refactor Puppet::SSL::* methods and spec tests	Closed	Tony Vu

Activity

People

Assignee:: Unassigned

Reporter:: Maggie Dreyer

Votes:: 0 Vote for this issue

Watchers:: 5 Start watching this issue

Dates

Created:: 2018/04/06 11:40 AM

Updated:: 2019/06/18 5:27 PM

Resolved:: 2018/09/19 12:33 PM