openvox 7.37.1

data/lib/puppet/ssl/oids.rb

@@ -0,0 +1,197 @@
+require_relative '../../puppet/ssl'
+
+# This module defines OIDs for use within Puppet.
+#
+# # ASN.1 Definition
+#
+# The following is the formal definition of OIDs specified in this file.
+#
+# ```
+# puppetCertExtensions OBJECT IDENTIFIER ::= {iso(1) identified-organization(3)
+#    dod(6) internet(1) private(4) enterprise(1) 34380 1}
+#
+# -- the tree under registeredExtensions 'belongs' to puppetlabs
+# -- privateExtensions can be extended by enterprises to suit their own needs
+# registeredExtensions OBJECT IDENTIFIER ::= { puppetCertExtensions 1 }
+# privateExtensions OBJECT IDENTIFIER ::= { puppetCertExtensions 2 }
+# authorizationExtensions OBJECT IDENTIFIER ::= { puppetCertExtensions 3 }
+#
+# -- subtree of common registered extensions
+# -- The short names for these OIDs are intentionally lowercased and formatted
+# -- since they may be exposed inside the Puppet DSL as variables.
+# pp_uuid  OBJECT IDENTIFIER ::= { registeredExtensions 1 }
+# pp_instance_id OBJECT IDENTIFIER ::= { registeredExtensions 2 }
+# pp_image_name OBJECT IDENTIFIER ::= { registeredExtensions 3 }
+# pp_preshared_key OBJECT IDENTIFIER ::= { registeredExtensions 4 }
+# ```
+#
+# @api private
+module Puppet::SSL::Oids
+
+  # Note: When updating the following OIDs make sure to also update the OID
+  # definitions here:
+  # https://github.com/puppetlabs/puppetserver/blob/master/src/clj/puppetlabs/puppetserver/certificate_authority.clj#L122-L159
+
+  PUPPET_OIDS = [
+    ["1.3.6.1.4.1.34380", 'puppetlabs', 'Puppet Labs'],
+    ["1.3.6.1.4.1.34380.1", 'ppCertExt', 'Puppet Certificate Extension'],
+
+    ["1.3.6.1.4.1.34380.1.1", 'ppRegCertExt', 'Puppet Registered Certificate Extension'],
+
+    ["1.3.6.1.4.1.34380.1.1.1", 'pp_uuid', 'Puppet Node UUID'],
+    ["1.3.6.1.4.1.34380.1.1.2", 'pp_instance_id', 'Puppet Node Instance ID'],
+    ["1.3.6.1.4.1.34380.1.1.3", 'pp_image_name', 'Puppet Node Image Name'],
+    ["1.3.6.1.4.1.34380.1.1.4", 'pp_preshared_key', 'Puppet Node Preshared Key'],
+    ["1.3.6.1.4.1.34380.1.1.5", 'pp_cost_center', 'Puppet Node Cost Center Name'],
+    ["1.3.6.1.4.1.34380.1.1.6", 'pp_product', 'Puppet Node Product Name'],
+    ["1.3.6.1.4.1.34380.1.1.7", 'pp_project', 'Puppet Node Project Name'],
+    ["1.3.6.1.4.1.34380.1.1.8", 'pp_application', 'Puppet Node Application Name'],
+    ["1.3.6.1.4.1.34380.1.1.9", 'pp_service', 'Puppet Node Service Name'],
+    ["1.3.6.1.4.1.34380.1.1.10", 'pp_employee', 'Puppet Node Employee Name'],
+    ["1.3.6.1.4.1.34380.1.1.11", 'pp_created_by', 'Puppet Node created_by Tag'],
+    ["1.3.6.1.4.1.34380.1.1.12", 'pp_environment', 'Puppet Node Environment Name'],
+    ["1.3.6.1.4.1.34380.1.1.13", 'pp_role', 'Puppet Node Role Name'],
+    ["1.3.6.1.4.1.34380.1.1.14", 'pp_software_version', 'Puppet Node Software Version'],
+    ["1.3.6.1.4.1.34380.1.1.15", 'pp_department', 'Puppet Node Department Name'],
+    ["1.3.6.1.4.1.34380.1.1.16", 'pp_cluster', 'Puppet Node Cluster Name'],
+    ["1.3.6.1.4.1.34380.1.1.17", 'pp_provisioner', 'Puppet Node Provisioner Name'],
+    ["1.3.6.1.4.1.34380.1.1.18", 'pp_region', 'Puppet Node Region Name'],
+    ["1.3.6.1.4.1.34380.1.1.19", 'pp_datacenter', 'Puppet Node Datacenter Name'],
+    ["1.3.6.1.4.1.34380.1.1.20", 'pp_zone', 'Puppet Node Zone Name'],
+    ["1.3.6.1.4.1.34380.1.1.21", 'pp_network', 'Puppet Node Network Name'],
+    ["1.3.6.1.4.1.34380.1.1.22", 'pp_securitypolicy', 'Puppet Node Security Policy Name'],
+    ["1.3.6.1.4.1.34380.1.1.23", 'pp_cloudplatform', 'Puppet Node Cloud Platform Name'],
+    ["1.3.6.1.4.1.34380.1.1.24", 'pp_apptier', 'Puppet Node Application Tier'],
+    ["1.3.6.1.4.1.34380.1.1.25", 'pp_hostname', 'Puppet Node Hostname'],
+    ["1.3.6.1.4.1.34380.1.1.26", 'pp_owner', 'Puppet Node Owner'],
+
+    ["1.3.6.1.4.1.34380.1.2", 'ppPrivCertExt', 'Puppet Private Certificate Extension'],
+
+    ["1.3.6.1.4.1.34380.1.3", 'ppAuthCertExt', 'Puppet Certificate Authorization Extension'],
+
+    ["1.3.6.1.4.1.34380.1.3.1",  'pp_authorization', 'Certificate Extension Authorization'],
+    ["1.3.6.1.4.1.34380.1.3.13", 'pp_auth_role', 'Puppet Node Role Name for Authorization'],
+    ["1.3.6.1.4.1.34380.1.3.39", 'pp_cli_auth', 'Puppetserver CA CLI Authorization'],
+  ]
+
+  @did_register_puppet_oids = false
+
+  # Register our custom Puppet OIDs with OpenSSL so they can be used as CSR
+  # extensions. Without registering these OIDs, OpenSSL will fail when it
+  # encounters such an extension in a CSR.
+  def self.register_puppet_oids()
+    if !@did_register_puppet_oids
+      PUPPET_OIDS.each do |oid_defn|
+        OpenSSL::ASN1::ObjectId.register(*oid_defn)
+      end
+
+      @did_register_puppet_oids = true
+    end
+  end
+
+  # Parse custom OID mapping file that enables custom OIDs to be resolved
+  # into user-friendly names.
+  #
+  # @param custom_oid_file [String] File to obtain custom OIDs mapping from
+  # @param map_key [String] Hash key in which custom OIDs mapping is stored
+  #
+  # @example Custom OID mapping file
+  # ---
+  # oid_mapping:
+  #  '1.3.6.1.4.1.34380.1.2.1.1':
+  #    shortname : 'myshortname'
+  #    longname  : 'Long name'
+  #  '1.3.6.1.4.1.34380.1.2.1.2':
+  #    shortname: 'myothershortname'
+  #    longname: 'Other Long name'
+  def self.parse_custom_oid_file(custom_oid_file, map_key='oid_mapping')
+    if File.exist?(custom_oid_file) && File.readable?(custom_oid_file)
+      mapping = nil
+      begin
+        mapping = Puppet::Util::Yaml.safe_load_file(custom_oid_file, [Symbol])
+      rescue => err
+        raise Puppet::Error, _("Error loading ssl custom OIDs mapping file from '%{custom_oid_file}': %{err}") % { custom_oid_file: custom_oid_file, err: err }, err.backtrace
+      end
+
+      unless mapping.has_key?(map_key)
+        raise Puppet::Error, _("Error loading ssl custom OIDs mapping file from '%{custom_oid_file}': no such index '%{map_key}'") % { custom_oid_file: custom_oid_file, map_key: map_key }
+      end
+
+      unless mapping[map_key].is_a?(Hash)
+        raise Puppet::Error, _("Error loading ssl custom OIDs mapping file from '%{custom_oid_file}': data under index '%{map_key}' must be a Hash") % { custom_oid_file: custom_oid_file, map_key: map_key }
+      end
+
+      oid_defns = []
+      mapping[map_key].keys.each do |oid|
+        shortname, longname = mapping[map_key][oid].values_at("shortname","longname")
+        if shortname.nil? || longname.nil?
+          raise Puppet::Error, _("Error loading ssl custom OIDs mapping file from '%{custom_oid_file}': incomplete definition of oid '%{oid}'") % { custom_oid_file: custom_oid_file, oid: oid }
+        end
+        oid_defns << [oid, shortname, longname]
+      end
+
+      oid_defns
+    end
+  end
+
+  # Load custom OID mapping file that enables custom OIDs to be resolved
+  # into user-friendly names.
+  #
+  # @param custom_oid_file [String] File to obtain custom OIDs mapping from
+  # @param map_key [String] Hash key in which custom OIDs mapping is stored
+  #
+  # @example Custom OID mapping file
+  # ---
+  # oid_mapping:
+  #  '1.3.6.1.4.1.34380.1.2.1.1':
+  #    shortname : 'myshortname'
+  #    longname  : 'Long name'
+  #  '1.3.6.1.4.1.34380.1.2.1.2':
+  #    shortname: 'myothershortname'
+  #    longname: 'Other Long name'
+  def self.load_custom_oid_file(custom_oid_file, map_key='oid_mapping')
+    oid_defns = parse_custom_oid_file(custom_oid_file, map_key)
+    unless oid_defns.nil?
+      begin
+        oid_defns.each do |oid_defn|
+          OpenSSL::ASN1::ObjectId.register(*oid_defn)
+        end
+      rescue => err
+        raise ArgumentError, _("Error registering ssl custom OIDs mapping from file '%{custom_oid_file}': %{err}") % { custom_oid_file: custom_oid_file, err: err }, err.backtrace
+      end
+    end
+  end
+
+  # Determine if the first OID contains the second OID
+  #
+  # @param first [String] The containing OID, in dotted form or as the short name
+  # @param second [String] The contained OID, in dotted form or as the short name
+  # @param exclusive [true, false] If an OID should not be considered as a subtree of itself
+  #
+  # @example Comparing two dotted OIDs
+  #   Puppet::SSL::Oids.subtree_of?('1.3.6.1', '1.3.6.1.4.1') #=> true
+  #   Puppet::SSL::Oids.subtree_of?('1.3.6.1', '1.3.6') #=> false
+  #
+  # @example Comparing an OID short name with a dotted OID
+  #   Puppet::SSL::Oids.subtree_of?('IANA', '1.3.6.1.4.1') #=> true
+  #   Puppet::SSL::Oids.subtree_of?('1.3.6.1', 'enterprises') #=> true
+  #
+  # @example Comparing an OID against itself
+  #   Puppet::SSL::Oids.subtree_of?('IANA', 'IANA') #=> true
+  #   Puppet::SSL::Oids.subtree_of?('IANA', 'IANA', true) #=> false
+  #
+  # @return [true, false]
+  def self.subtree_of?(first, second, exclusive = false)
+    first_oid = OpenSSL::ASN1::ObjectId.new(first).oid
+    second_oid = OpenSSL::ASN1::ObjectId.new(second).oid
+
+
+    if exclusive and first_oid == second_oid
+      false
+    else
+      second_oid.index(first_oid) == 0
+    end
+  rescue OpenSSL::ASN1::ASN1Error, TypeError
+    false
+  end
+end

data/lib/puppet/ssl/openssl_loader.rb

@@ -0,0 +1,24 @@
+require_relative '../../puppet/util/platform'
+
+# This file should be required instead of writing `require 'openssl'`
+# or any library that loads openssl like `net/https`. This allows the
+# core Puppet code to load correctly in JRuby environments that do not
+# have a functioning openssl (eg a FIPS enabled one).
+
+unless Puppet::Util::Platform.jruby_fips?
+  require 'openssl'
+  require 'net/https'
+else
+  # Even in JRuby we need to define the constants that are wrapped in
+  # Indirections: Puppet::SSL::{Key, Certificate, CertificateRequest}
+  module OpenSSL
+    module PKey
+      class RSA; end
+    end
+
+    module X509
+      class Request; end
+      class Certificate; end
+    end
+  end
+end

data/lib/puppet/ssl/ssl_context.rb

@@ -0,0 +1,25 @@
+require_relative '../../puppet/ssl'
+
+module Puppet::SSL
+  # The `keyword_init: true` option is no longer needed in Ruby >= 3.2
+  SSLContext = Struct.new(
+    :store,
+    :cacerts,
+    :crls,
+    :private_key,
+    :client_cert,
+    :client_chain,
+    :revocation,
+    :verify_peer,
+    keyword_init: true
+  ) do
+    def initialize(*)
+      super
+      self[:cacerts] ||= []
+      self[:crls] ||= []
+      self[:client_chain] ||= []
+      self[:revocation] = true if self[:revocation].nil?
+      self[:verify_peer] = true if self[:verify_peer].nil?
+    end
+  end
+end

data/lib/puppet/ssl/ssl_provider.rb

@@ -0,0 +1,350 @@
+require_relative '../../puppet/ssl'
+
+# SSL Provider creates `SSLContext` objects that can be used to create
+# secure connections.
+#
+# @example To load an SSLContext from an existing private key and related certs/crls:
+#   ssl_context = provider.load_context
+#
+# @example To load an SSLContext from an existing password-protected private key and related certs/crls:
+#   ssl_context = provider.load_context(password: 'opensesame')
+#
+# @example To create an SSLContext from in-memory certs and keys:
+#   cacerts = [<OpenSSL::X509::Certificate>]
+#   crls = [<OpenSSL::X509::CRL>]
+#   key = <OpenSSL::X509::PKey>
+#   cert = <OpenSSL::X509::Certificate>
+#   ssl_context = provider.create_context(cacerts: cacerts, crls: crls, private_key: key, client_cert: cert)
+#
+# @example To create an SSLContext to connect to non-puppet HTTPS servers:
+#   cacerts = [<OpenSSL::X509::Certificate>]
+#   ssl_context = provider.create_root_context(cacerts: cacerts)
+#
+# @api private
+class Puppet::SSL::SSLProvider
+  # Create an insecure `SSLContext`. Connections made from the returned context
+  # will not authenticate the server, i.e. `VERIFY_NONE`, and are vulnerable to
+  # MITM. Do not call this method.
+  #
+  # @return [Puppet::SSL::SSLContext] A context to use to create connections
+  # @api private
+  def create_insecure_context
+    store = create_x509_store([], [], false)
+
+    Puppet::SSL::SSLContext.new(store: store, verify_peer: false).freeze
+  end
+
+  # Create an `SSLContext` using the trusted `cacerts` and optional `crls`.
+  # Connections made from the returned context will authenticate the server,
+  # i.e. `VERIFY_PEER`, but will not use a client certificate.
+  #
+  # The `crls` parameter must contain CRLs corresponding to each CA in `cacerts`
+  # depending on the `revocation` mode. See {#create_context}.
+  #
+  # @param cacerts [Array<OpenSSL::X509::Certificate>] Array of trusted CA certs
+  # @param crls [Array<OpenSSL::X509::CRL>] Array of CRLs
+  # @param revocation [:chain, :leaf, false] revocation mode
+  # @return [Puppet::SSL::SSLContext] A context to use to create connections
+  # @raise (see #create_context)
+  # @api private
+  def create_root_context(cacerts:, crls: [], revocation: Puppet[:certificate_revocation])
+    store = create_x509_store(cacerts, crls, revocation)
+
+    Puppet::SSL::SSLContext.new(store: store, cacerts: cacerts, crls: crls, revocation: revocation).freeze
+  end
+
+  # Create an `SSLContext` using the trusted `cacerts` and any certs in OpenSSL's
+  # default verify path locations. When running puppet as a gem, the location is
+  # system dependent. When running puppet from puppet-agent packages, the location
+  # refers to the cacerts bundle in the puppet-agent package.
+  #
+  # Connections made from the returned context will authenticate the server,
+  # i.e. `VERIFY_PEER`, but will not use a client certificate (unless requested)
+  # and will not perform revocation checking.
+  #
+  # @param cacerts [Array<OpenSSL::X509::Certificate>] Array of trusted CA certs
+  # @param path [String, nil] A file containing additional trusted CA certs.
+  # @param include_client_cert [true, false] If true, the client cert will be added to the context
+  #   allowing mutual TLS authentication. The default is false. If the client cert doesn't exist
+  #   then the option will be ignored.
+  # @return [Puppet::SSL::SSLContext] A context to use to create connections
+  # @raise (see #create_context)
+  # @api private
+  def create_system_context(cacerts:, path: Puppet[:ssl_trust_store], include_client_cert: false)
+    store = create_x509_store(cacerts, [], false, include_system_store: true)
+
+    if path
+      stat = Puppet::FileSystem.stat(path)
+      if stat
+        if stat.ftype == 'file'
+          # don't add empty files as ruby/openssl will raise
+          if stat.size > 0
+            begin
+              store.add_file(path)
+            rescue => e
+              Puppet.err(_("Failed to add '%{path}' as a trusted CA file: %{detail}" % { path: path, detail: e.message }, e))
+            end
+          end
+        else
+          Puppet.warning(_("The 'ssl_trust_store' setting does not refer to a file and will be ignored: '%{path}'" % { path: path }))
+        end
+      end
+    end
+
+    if include_client_cert
+      cert_provider = Puppet::X509::CertProvider.new
+      private_key = cert_provider.load_private_key(Puppet[:certname], required: false)
+      unless private_key
+        Puppet.warning("Private key for '#{Puppet[:certname]}' does not exist")
+      end
+
+      client_cert = cert_provider.load_client_cert(Puppet[:certname], required: false)
+      unless client_cert
+        Puppet.warning("Client certificate for '#{Puppet[:certname]}' does not exist")
+      end
+
+      if private_key && client_cert
+        client_chain = resolve_client_chain(store, client_cert, private_key)
+
+        return Puppet::SSL::SSLContext.new(
+          store: store, cacerts: cacerts, crls: [],
+          private_key: private_key, client_cert: client_cert, client_chain: client_chain,
+          revocation: false
+        ).freeze
+      end
+    end
+
+    Puppet::SSL::SSLContext.new(store: store, cacerts: cacerts, crls: [], revocation: false).freeze
+  end
+
+  # Create an `SSLContext` using the trusted `cacerts`, `crls`, `private_key`,
+  # `client_cert`, and `revocation` mode. Connections made from the returned
+  # context will be mutually authenticated.
+  #
+  # The `crls` parameter must contain CRLs corresponding to each CA in `cacerts`
+  # depending on the `revocation` mode:
+  #
+  # * `:chain` - `crls` must contain a CRL for every CA in `cacerts`
+  # * `:leaf` - `crls` must contain (at least) the CRL for the leaf CA in `cacerts`
+  # * `false` - `crls` can be empty
+  #
+  # The `private_key` and public key from the `client_cert` must match.
+  #
+  # @param cacerts [Array<OpenSSL::X509::Certificate>] Array of trusted CA certs
+  # @param crls [Array<OpenSSL::X509::CRL>] Array of CRLs
+  # @param private_key [OpenSSL::PKey::RSA, OpenSSL::PKey::EC] client's private key
+  # @param client_cert [OpenSSL::X509::Certificate] client's cert whose public
+  #   key matches the `private_key`
+  # @param revocation [:chain, :leaf, false] revocation mode
+  # @param include_system_store [true, false] Also trust system CA
+  # @return [Puppet::SSL::SSLContext] A context to use to create connections
+  # @raise [Puppet::SSL::CertVerifyError] There was an issue with
+  #   one of the certs or CRLs.
+  # @raise [Puppet::SSL::SSLError] There was an issue with the
+  #   `private_key`.
+  # @api private
+  def create_context(cacerts:, crls:, private_key:, client_cert:, revocation: Puppet[:certificate_revocation], include_system_store: false)
+    raise ArgumentError, _("CA certs are missing") unless cacerts
+    raise ArgumentError, _("CRLs are missing") unless crls
+    raise ArgumentError, _("Private key is missing") unless private_key
+    raise ArgumentError, _("Client cert is missing") unless client_cert
+
+    store = create_x509_store(cacerts, crls, revocation, include_system_store: include_system_store)
+    client_chain = resolve_client_chain(store, client_cert, private_key)
+
+    Puppet::SSL::SSLContext.new(
+      store: store, cacerts: cacerts, crls: crls,
+      private_key: private_key, client_cert: client_cert, client_chain: client_chain,
+      revocation: revocation
+    ).freeze
+  end
+
+  # Load an `SSLContext` using available certs and keys. An exception is raised
+  # if any component is missing or is invalid, such as a mismatched client cert
+  # and private key. Connections made from the returned context will be mutually
+  # authenticated.
+  #
+  # @param certname [String] Which cert & key to load
+  # @param revocation [:chain, :leaf, false] revocation mode
+  # @param password [String, nil] If the private key is encrypted, decrypt
+  #   it using the password. If the key is encrypted, but a password is
+  #   not specified, then the key cannot be loaded.
+  # @param include_system_store [true, false] Also trust system CA
+  # @return [Puppet::SSL::SSLContext] A context to use to create connections
+  # @raise [Puppet::SSL::CertVerifyError] There was an issue with
+  #   one of the certs or CRLs.
+  # @raise [Puppet::Error] There was an issue with one of the required components.
+  # @api private
+  def load_context(certname: Puppet[:certname], revocation: Puppet[:certificate_revocation], password: nil, include_system_store: false)
+    cert = Puppet::X509::CertProvider.new
+    cacerts = cert.load_cacerts(required: true)
+    crls = case revocation
+           when :chain, :leaf
+             cert.load_crls(required: true)
+           else
+             []
+           end
+    private_key = cert.load_private_key(certname, required: true, password: password)
+    client_cert = cert.load_client_cert(certname, required: true)
+
+    create_context(cacerts: cacerts, crls: crls,  private_key: private_key, client_cert: client_cert, revocation: revocation, include_system_store: include_system_store)
+  rescue OpenSSL::PKey::PKeyError => e
+    raise Puppet::SSL::SSLError.new(_("Failed to load private key for host '%{name}': %{message}") % { name: certname, message: e.message }, e)
+  end
+
+  # Verify the `csr` was signed with a private key corresponding to the
+  # `public_key`. This ensures the CSR was signed by someone in possession
+  # of the private key, and that it hasn't been tampered with since.
+  #
+  # @param csr [OpenSSL::X509::Request] certificate signing request
+  # @param public_key [OpenSSL::PKey::RSA, OpenSSL::PKey::EC] public key
+  # @raise [Puppet::SSL:SSLError] The private_key for the given `public_key` was
+  #   not used to sign the CSR.
+  # @api private
+  def verify_request(csr, public_key)
+    unless csr.verify(public_key)
+      raise Puppet::SSL::SSLError, _("The CSR for host '%{name}' does not match the public key") % { name: subject(csr) }
+    end
+
+    csr
+  end
+
+  def print(ssl_context, alg = 'SHA256')
+    if Puppet::Util::Log.sendlevel?(:debug)
+      chain = ssl_context.client_chain
+      # print from root to client
+      chain.reverse.each_with_index do |cert, i|
+        digest = Puppet::SSL::Digest.new(alg, cert.to_der)
+        if i == chain.length - 1
+          Puppet.debug(_("Verified client certificate '%{subject}' fingerprint %{digest}") % {subject: cert.subject.to_utf8, digest: digest})
+        else
+          Puppet.debug(_("Verified CA certificate '%{subject}' fingerprint %{digest}") % {subject: cert.subject.to_utf8, digest: digest})
+        end
+      end
+      ssl_context.crls.each do |crl|
+        oid_values = Hash[crl.extensions.map { |ext| [ext.oid, ext.value] }]
+        crlNumber = oid_values['crlNumber'] || 'unknown'
+        authKeyId = (oid_values['authorityKeyIdentifier'] || 'unknown').chomp!
+        Puppet.debug("Using CRL '#{crl.issuer.to_utf8}' authorityKeyIdentifier '#{authKeyId}' crlNumber '#{crlNumber }'")
+      end
+    end
+  end
+
+  private
+
+  def default_flags
+    # checking the signature of the self-signed cert doesn't add any security,
+    # but it's a sanity check to make sure the cert isn't corrupt. This option
+    # is only available in openssl 1.1+
+    if defined?(OpenSSL::X509::V_FLAG_CHECK_SS_SIGNATURE)
+      OpenSSL::X509::V_FLAG_CHECK_SS_SIGNATURE
+    else
+      0
+    end
+  end
+
+  def create_x509_store(roots, crls, revocation, include_system_store: false)
+    store = OpenSSL::X509::Store.new
+    store.purpose = OpenSSL::X509::PURPOSE_ANY
+    store.flags = default_flags | revocation_mode(revocation)
+
+    roots.each { |cert| store.add_cert(cert) }
+    crls.each { |crl| store.add_crl(crl) }
+
+    store.set_default_paths if include_system_store
+
+    store
+  end
+
+  def subject(x509)
+    x509.subject.to_utf8
+  end
+
+  def issuer(x509)
+    x509.issuer.to_utf8
+  end
+
+  def revocation_mode(mode)
+    case mode
+    when false
+      0
+    when :leaf
+      OpenSSL::X509::V_FLAG_CRL_CHECK
+    else
+      # :chain is the default
+      OpenSSL::X509::V_FLAG_CRL_CHECK | OpenSSL::X509::V_FLAG_CRL_CHECK_ALL
+    end
+  end
+
+  def resolve_client_chain(store, client_cert, private_key)
+    client_chain = verify_cert_with_store(store, client_cert)
+
+    if !private_key.is_a?(OpenSSL::PKey::RSA) && !private_key.is_a?(OpenSSL::PKey::EC)
+      raise Puppet::SSL::SSLError, _("Unsupported key '%{type}'") % { type: private_key.class.name }
+    end
+
+    unless client_cert.check_private_key(private_key)
+      raise Puppet::SSL::SSLError, _("The certificate for '%{name}' does not match its private key") % { name: subject(client_cert) }
+    end
+
+    client_chain
+  end
+
+  def verify_cert_with_store(store, cert)
+    # StoreContext#initialize accepts a chain argument, but it's set to [] because
+    # puppet requires any intermediate CA certs needed to complete the client's
+    # chain to be in the CA bundle that we downloaded from the server, and
+    # they've already been added to the store. See PUP-9500.
+
+    store_context = OpenSSL::X509::StoreContext.new(store, cert, [])
+    unless store_context.verify
+      current_cert = store_context.current_cert
+
+      # If the client cert's intermediate CA is not in the CA bundle, then warn,
+      # but don't error, because SSL allows the client to send an incomplete
+      # chain, and have the server resolve it.
+      if store_context.error == OpenSSL::X509::V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY
+        Puppet.warning _("The issuer '%{issuer}' of certificate '%{subject}' cannot be found locally") % {
+          issuer: issuer(current_cert), subject: subject(current_cert)
+        }
+      else
+        raise_cert_verify_error(store_context, current_cert)
+      end
+    end
+
+    # resolved chain from leaf to root
+    store_context.chain
+  end
+
+  def raise_cert_verify_error(store_context, current_cert)
+    message =
+      case store_context.error
+      when OpenSSL::X509::V_ERR_CERT_NOT_YET_VALID
+        _("The certificate '%{subject}' is not yet valid, verify time is synchronized") % { subject: subject(current_cert) }
+      when OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED
+        _("The certificate '%{subject}' has expired, verify time is synchronized") %  { subject: subject(current_cert) }
+      when OpenSSL::X509::V_ERR_CRL_NOT_YET_VALID
+        _("The CRL issued by '%{issuer}' is not yet valid, verify time is synchronized") % { issuer: issuer(current_cert) }
+      when OpenSSL::X509::V_ERR_CRL_HAS_EXPIRED
+        _("The CRL issued by '%{issuer}' has expired, verify time is synchronized") % { issuer: issuer(current_cert) }
+      when OpenSSL::X509::V_ERR_CERT_SIGNATURE_FAILURE
+        _("Invalid signature for certificate '%{subject}'") % { subject: subject(current_cert) }
+      when OpenSSL::X509::V_ERR_CRL_SIGNATURE_FAILURE
+        _("Invalid signature for CRL issued by '%{issuer}'") % { issuer: issuer(current_cert) }
+      when OpenSSL::X509::V_ERR_UNABLE_TO_GET_ISSUER_CERT
+        _("The issuer '%{issuer}' of certificate '%{subject}' is missing") % {
+          issuer: issuer(current_cert), subject: subject(current_cert) }
+      when OpenSSL::X509::V_ERR_UNABLE_TO_GET_CRL
+        _("The CRL issued by '%{issuer}' is missing") % { issuer: issuer(current_cert) }
+      when OpenSSL::X509::V_ERR_CERT_REVOKED
+        _("Certificate '%{subject}' is revoked") % { subject: subject(current_cert) }
+      else
+        # error_string is labeled ASCII-8BIT, but is encoded based on Encoding.default_external
+        err_utf8 = Puppet::Util::CharacterEncoding.convert_to_utf_8(store_context.error_string)
+        _("Certificate '%{subject}' failed verification (%{err}): %{err_utf8}") % {
+          subject: subject(current_cert), err: store_context.error, err_utf8: err_utf8 }
+      end
+
+    raise Puppet::SSL::CertVerifyError.new(message, store_context.error, current_cert)
+  end
+end