Uploaded image for project: 'Puppet Server'
  1. Puppet Server
  2. SERVER-2943

Allow clj-http-client to optionally load system stores from agent's bundle

    XMLWordPrintable

Details

    • Task
    • Status: Resolved
    • Normal
    • Resolution: Duplicate
    • None
    • None
    • None
    • None
    • Needs Assessment

    Description

      Currently, jvm-ssl-utils can only create SSL contexts that have Puppet's internal certs and keys added. Users want to be able to use an SSLContext that also trusts certificates in the system keystore. Puppet's new HTTP client API provides a flag, include_system_store, that should enable this mode.

      We need to change the spot where we create our SSL context to optionally allow including certs from the system store (in addition to the Puppet certs). These are installed with puppet-agent as a bundle to /opt/puppetlabs/puppet/ssl/cert.pem. This may or may not require updates to jvm-ssl-utils.

      In order to facilitate testing, this should be implemented so that the path to the certs is configurable, and doesn't try to just hard-code the location of the additional certs to be loaded.

      Attachments

        Issue Links

          Activity

            People

              justin Justin Stoller
              maggie Maggie Dreyer
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Zendesk Support