puppet 4.0.0 → 5.0.0

data/spec/unit/ssl/certificate_authority_spec.rb

@@ -167,7 +167,7 @@ describe Puppet::SSL::CertificateAuthority do
       Puppet::FileSystem.expects(:exist?).with(Puppet[:capass]).returns false
 
       fh = StringIO.new
-      Puppet.settings.setting(:capass).expects(:open).with('w').yields fh
+      Puppet.settings.setting(:capass).expects(:open).with('w:ASCII').yields fh
 
       @ca.stubs(:sign)
 
@@ -192,7 +192,8 @@ describe Puppet::SSL::CertificateAuthority do
       request.expects(:generate).with(@ca.host.key)
       request.stubs(:request_extensions => [])
 
-      @ca.expects(:sign).with(@host.name, false, request)
+      @ca.expects(:sign).with(@host.name, {allow_dns_alt_names: false,
+                                           self_signing_csr: request})
 
       @ca.stubs :generate_password
 
@@ -256,49 +257,56 @@ describe Puppet::SSL::CertificateAuthority do
       it "should not look up a certificate request for the host" do
         Puppet::SSL::CertificateRequest.indirection.expects(:find).never
 
-        @ca.sign(@name, true, @request)
+        @ca.sign(@name, {allow_dns_alt_names: true,
+                         self_signing_csr: @request})
       end
 
       it "should use a certificate type of :ca" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           expect(args[0]).to eq(:ca)
         end.returns @cert.content
-        @ca.sign(@name, :ca, @request)
+        @ca.sign(@name, {allow_dns_alt_names: true,
+                         self_signing_csr: @request})
       end
 
       it "should pass the provided CSR as the CSR" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           expect(args[1]).to eq(@request)
         end.returns @cert.content
-        @ca.sign(@name, :ca, @request)
+        @ca.sign(@name, {allow_dns_alt_names: true,
+                         self_signing_csr: @request})
       end
 
       it "should use the provided CSR's content as the issuer" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           expect(args[2].subject.to_s).to eq("/CN=myhost")
         end.returns @cert.content
-        @ca.sign(@name, :ca, @request)
+        @ca.sign(@name, {allow_dns_alt_names: true,
+                         self_signing_csr: @request})
       end
 
       it "should pass the next serial as the serial number" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           expect(args[3]).to eq(@serial)
         end.returns @cert.content
-        @ca.sign(@name, :ca, @request)
+        @ca.sign(@name, {allow_dns_alt_names: true,
+                         self_signing_csr: @request})
       end
 
       it "should sign the certificate request even if it contains alt names" do
         @request.stubs(:subject_alt_names).returns %w[DNS:foo DNS:bar DNS:baz]
 
         expect do
-          @ca.sign(@name, false, @request)
+          @ca.sign(@name, {allow_dns_alt_names: false,
+                           self_signing_csr: @request})
         end.not_to raise_error
       end
 
       it "should save the resulting certificate" do
         Puppet::SSL::Certificate.indirection.expects(:save).with(@cert)
 
-        @ca.sign(@name, :ca, @request)
+        @ca.sign(@name, {allow_dns_alt_names: true,
+                         self_signing_csr: @request})
       end
     end
 
@@ -339,17 +347,37 @@ describe Puppet::SSL::CertificateAuthority do
         }.to raise_error(/CSR has request extensions that are not permitted/)
       end
 
+      it "should reject auth extensions" do
+        @request.stubs :request_extensions => [{"oid" => "1.3.6.1.4.1.34380.1.3.1",
+                                                "value" => "true"},
+                                               {"oid" => "1.3.6.1.4.1.34380.1.3.13",
+                                                "value" => "com"}]
+
+        expect {
+          @ca.sign(@name)
+        }.to raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError,
+                         /CSR '#{@name}' contains authorization extensions (.*?, .*?).*/)
+      end
+
+      it "should not fail if the CSR contains auth extensions and they're allowed" do
+        @request.stubs :request_extensions => [{"oid" => "1.3.6.1.4.1.34380.1.3.1",
+                                                "value" => "true"},
+                                               {"oid" => "1.3.6.1.4.1.34380.1.3.13",
+                                                "value" => "com"}]
+        expect { @ca.sign(@name, {allow_authorization_extensions: true})}.to_not raise_error
+      end
+
       it "should fail if the CSR contains alt names and they are not expected" do
         @request.stubs(:subject_alt_names).returns %w[DNS:foo DNS:bar DNS:baz]
 
         expect do
-          @ca.sign(@name, false)
+          @ca.sign(@name, {allow_dns_alt_names: false})
         end.to raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError, /CSR '#{@name}' contains subject alternative names \(.*?\), which are disallowed. Use `puppet cert --allow-dns-alt-names sign #{@name}` to sign this request./)
       end
 
       it "should not fail if the CSR does not contain alt names and they are expected" do
         @request.stubs(:subject_alt_names).returns []
-        expect { @ca.sign(@name, true) }.to_not raise_error
+        expect { @ca.sign(@name, {allow_dns_alt_names: true}) }.to_not raise_error
       end
 
       it "should reject alt names by default" do
@@ -421,7 +449,7 @@ describe Puppet::SSL::CertificateAuthority do
         csr.generate(key)
 
         expect do
-          @ca.check_internal_signing_policies('not_the_certname', csr, false)
+          @ca.check_internal_signing_policies('not_the_certname', csr)
         end.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /common name "the_certname" does not match expected certname "not_the_certname"/
@@ -449,7 +477,7 @@ describe Puppet::SSL::CertificateAuthority do
             csr = Puppet::SSL::CertificateRequest.new(name)
             csr.generate(@signing_key)
 
-            @ca.check_internal_signing_policies(name, csr, false)
+            @ca.check_internal_signing_policies(name, csr)
           end
         end
 
@@ -468,7 +496,7 @@ describe Puppet::SSL::CertificateAuthority do
             csr.generate(@signing_key)
 
             expect do
-              @ca.check_internal_signing_policies(name, csr, false)
+              @ca.check_internal_signing_policies(name, csr)
             end.to raise_error(
               Puppet::SSL::CertificateAuthority::CertificateSigningError,
               /subject contains unprintable or non-ASCII characters/
@@ -484,7 +512,7 @@ describe Puppet::SSL::CertificateAuthority do
         @request.stubs(:request_extensions).returns exts
 
         expect {
-          @ca.check_internal_signing_policies(@name, @request, false)
+          @ca.check_internal_signing_policies(@name, @request)
         }.to_not raise_error
       end
 
@@ -495,7 +523,7 @@ describe Puppet::SSL::CertificateAuthority do
         @request.stubs(:request_extensions).returns exts
 
         expect {
-          @ca.check_internal_signing_policies(@name, @request, false)
+          @ca.check_internal_signing_policies(@name, @request)
         }.to_not raise_error
       end
 
@@ -506,7 +534,7 @@ describe Puppet::SSL::CertificateAuthority do
         @request.stubs(:request_extensions).returns exts
 
         expect {
-          @ca.check_internal_signing_policies(@name, @request, false)
+          @ca.check_internal_signing_policies(@name, @request)
         }.to_not raise_error
       end
 
@@ -515,7 +543,7 @@ describe Puppet::SSL::CertificateAuthority do
         @request.stubs(:request_extensions).returns [{ "oid" => "banana",
                                                        "value" => "yumm",
                                                        "critical" => true }]
-        expect { @ca.check_internal_signing_policies(@name, @request, false) }.to raise_error(
+        expect { @ca.check_internal_signing_policies(@name, @request) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /request extensions that are not permitted/
         )
@@ -525,7 +553,7 @@ describe Puppet::SSL::CertificateAuthority do
         @request.stubs(:request_extensions).returns [{ "oid" => "peach",
                                                        "value" => "meh",
                                                        "critical" => false }]
-        expect { @ca.check_internal_signing_policies(@name, @request, false) }.to raise_error(
+        expect { @ca.check_internal_signing_policies(@name, @request) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /request extensions that are not permitted/
         )
@@ -538,7 +566,7 @@ describe Puppet::SSL::CertificateAuthority do
                                                      { "oid" => "subjectAltName",
                                                        "value" => "DNS:foo",
                                                        "critical" => true }]
-        expect { @ca.check_internal_signing_policies(@name, @request, false) }.to raise_error(
+        expect { @ca.check_internal_signing_policies(@name, @request) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /request extensions that are not permitted/
         )
@@ -546,17 +574,28 @@ describe Puppet::SSL::CertificateAuthority do
 
       it "should reject a subjectAltName for a non-DNS value" do
         @request.stubs(:subject_alt_names).returns ['DNS:foo', 'email:bar@example.com']
-        expect { @ca.check_internal_signing_policies(@name, @request, true) }.to raise_error(
+        expect {
+          @ca.check_internal_signing_policies(@name, @request, {allow_dns_alt_names: true})
+        }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /subjectAltName outside the DNS label space/
         )
       end
 
+      it "should allow a subjectAltName if subject matches CA's certname" do
+        @request.stubs(:subject_alt_names).returns ['DNS:foo']
+        Puppet[:certname] = @name
+
+        expect {
+          @ca.check_internal_signing_policies(@name, @request, {allow_dns_alt_names: false})
+        }.to_not raise_error
+      end
+
       it "should reject a wildcard subject" do
         @request.content.stubs(:subject).
           returns(OpenSSL::X509::Name.new([["CN", "*.local"]]))
 
-        expect { @ca.check_internal_signing_policies('*.local', @request, false) }.to raise_error(
+        expect { @ca.check_internal_signing_policies('*.local', @request) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /subject contains a wildcard/
         )
@@ -564,7 +603,9 @@ describe Puppet::SSL::CertificateAuthority do
 
       it "should reject a wildcard subjectAltName" do
         @request.stubs(:subject_alt_names).returns ['DNS:foo', 'DNS:*.bar']
-        expect { @ca.check_internal_signing_policies(@name, @request, true) }.to raise_error(
+        expect {
+          @ca.check_internal_signing_policies(@name, @request, {allow_dns_alt_names: true})
+        }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /subjectAltName contains a wildcard/
         )
@@ -754,6 +795,12 @@ describe Puppet::SSL::CertificateAuthority do
       expect(@ca.list_certificates).to eq([cert1, cert2])
     end
 
+    it "should print a deprecation when using #list_certificates" do
+      Puppet::SSL::Certificate.indirection.stubs(:search).with("*").returns [:foo, :bar]
+      Puppet.expects(:deprecation_warning).with(regexp_matches(/list_certificates is deprecated/))
+      @ca.list_certificates
+    end
+
     describe "and printing certificates" do
       it "should return nil if the certificate cannot be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns nil
@@ -777,7 +824,7 @@ describe Puppet::SSL::CertificateAuthority do
       it "should raise an error if the certificate or CSR cannot be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns nil
         Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myhost").returns nil
-        expect { @ca.fingerprint("myhost") }.to raise_error
+        expect { @ca.fingerprint("myhost") }.to raise_error(ArgumentError, /Could not find a certificate/)
       end
 
       it "should try to find a CSR if no certificate can be found" do
@@ -863,8 +910,10 @@ describe Puppet::SSL::CertificateAuthority do
         @cert.expects(:content).returns "mycert"
 
         @store.expects(:verify).with("mycert").returns false
+        @store.expects(:error)
+        @store.expects(:error_string)
 
-        expect { @ca.verify("me") }.to raise_error
+        expect { @ca.verify("me") }.to raise_error(Puppet::SSL::CertificateAuthority::CertificateVerificationError)
       end
 
       describe "certificate_is_alive?" do
@@ -884,7 +933,7 @@ describe Puppet::SSL::CertificateAuthority do
           expect(@ca.certificate_is_alive?(@cert)).to be_truthy
         end
 
-        it "should used a cached instance of the x509 store" do
+        it "should use a cached instance of the x509 store" do
           OpenSSL::X509::Store.stubs(:new).returns(@store).once
 
           @cert.expects(:content).returns "mycert"
@@ -894,6 +943,11 @@ describe Puppet::SSL::CertificateAuthority do
           @ca.certificate_is_alive?(@cert)
           @ca.certificate_is_alive?(@cert)
         end
+
+        it "should be deprecated" do
+          Puppet.expects(:deprecation_warning).with(regexp_matches(/certificate_is_alive\? is deprecated/))
+          @ca.certificate_is_alive?(@cert)
+        end
       end
     end
 
@@ -963,7 +1017,7 @@ describe Puppet::SSL::CertificateAuthority do
         @ca.inventory.expects(:serials).with("host").returns []
 
         @ca.crl.expects(:revoke).never
-        expect { @ca.revoke('host') }.to raise_error
+        expect { @ca.revoke('host') }.to raise_error(ArgumentError, /Could not find a serial number for host/)
       end
 
       context "revocation by serial number (#16798)" do
@@ -1013,7 +1067,7 @@ describe "CertificateAuthority.generate" do
   end
 
   def expect_to_write_the_ca_password
-    Puppet.settings.setting(:capass).expects(:open).with('w')
+    Puppet.settings.setting(:capass).expects(:open).with('w:ASCII')
   end
 
   def expect_ca_initialization

data/spec/unit/ssl/certificate_factory_spec.rb

@@ -32,12 +32,12 @@ describe Puppet::SSL::CertificateFactory do
 
     it "should set the certificate's subject to the CSR's subject" do
       cert = subject.build(:server, csr, issuer, serial)
-      expect(cert.subject).to eql x509_name
+      expect(cert.subject).to eq x509_name
     end
 
     it "should set the certificate's issuer to the Issuer's subject" do
       cert = subject.build(:server, csr, issuer, serial)
-      expect(cert.issuer).to eql issuer.subject
+      expect(cert.issuer).to eq issuer.subject
     end
 
     it "should set the certificate's public key to the CSR's public key" do

data/spec/unit/ssl/certificate_request_attributes_spec.rb

@@ -9,6 +9,12 @@ describe Puppet::SSL::CertificateRequestAttributes do
       "custom_attributes" => {
         "1.3.6.1.4.1.34380.2.2"=>[3232235521, 3232235777], # system IPs in hex
         "1.3.6.1.4.1.34380.2.0"=>"hostname.domain.com",
+        # different UTF-8 widths
+        # 1-byte A
+        # 2-byte ۿ - http://www.fileformat.info/info/unicode/char/06ff/index.htm - 0xDB 0xBF / 219 191
+        # 3-byte ᚠ - http://www.fileformat.info/info/unicode/char/16A0/index.htm - 0xE1 0x9A 0xA0 / 225 154 160
+        # 4-byte 𠜎 - http://www.fileformat.info/info/unicode/char/2070E/index.htm - 0xF0 0xA0 0x9C 0x8E / 240 160 156 142
+        "1.2.840.113549.1.9.7"=>"utf8passwordA\u06FF\u16A0\u{2070E}"
       }
     }
   end

data/spec/unit/ssl/certificate_request_spec.rb

@@ -60,7 +60,7 @@ describe Puppet::SSL::CertificateRequest do
 
     it "should be able to read requests from disk" do
       path = "/my/path"
-      File.expects(:read).with(path).returns("my request")
+      Puppet::FileSystem.expects(:read).with(path, :encoding => Encoding::ASCII).returns("my request")
       my_req = mock 'request'
       OpenSSL::X509::Request.expects(:new).with("my request").returns(my_req)
       expect(request.read(path)).to equal(my_req)
@@ -92,14 +92,13 @@ describe Puppet::SSL::CertificateRequest do
 
     it "should set the subject to [CN, name]" do
       request.generate(key)
-      # OpenSSL::X509::Name only implements equality as `eql?`
-      expect(request.content.subject).to eql OpenSSL::X509::Name.new([['CN', key.name]])
+      expect(request.content.subject).to eq OpenSSL::X509::Name.new([['CN', key.name]])
     end
 
     it "should set the CN to the :ca_name setting when the CSR is for a CA" do
       Puppet[:ca_name] = "mycertname"
       request = described_class.new(Puppet::SSL::CA_NAME).generate(key)
-      expect(request.subject).to eql OpenSSL::X509::Name.new([['CN', Puppet[:ca_name]]])
+      expect(request.subject).to eq OpenSSL::X509::Name.new([['CN', Puppet[:ca_name]]])
     end
 
     it "should set the version to 0" do
@@ -287,7 +286,7 @@ describe Puppet::SSL::CertificateRequest do
         exts = {"thats.no.moon" => "death star"}
         expect do
           request.generate(key, :extension_requests => exts)
-        end.to raise_error Puppet::Error, /Cannot create CSR with extension request thats\.no\.moon: first num too large/
+        end.to raise_error Puppet::Error, /Cannot create CSR with extension request thats\.no\.moon.*: first num too large/
       end
     end
 

data/spec/unit/ssl/certificate_revocation_list_spec.rb

@@ -105,14 +105,14 @@ describe Puppet::SSL::CertificateRevocationList do
     end
 
     it "returns the last update time in UTC" do
-      # http://tools.ietf.org/html/rfc5280#section-5.1.2.4
+      # https://tools.ietf.org/html/rfc5280#section-5.1.2.4
       thisUpdate = @crl.generate(@cert, @key).last_update
       expect(thisUpdate).to be_utc
       expects_time_close_to_now(thisUpdate)
     end
 
     it "returns the next update time in UTC 5 years from now" do
-      # http://tools.ietf.org/html/rfc5280#section-5.1.2.5
+      # https://tools.ietf.org/html/rfc5280#section-5.1.2.5
       nextUpdate = @crl.generate(@cert, @key).next_update
       expect(nextUpdate).to be_utc
       expects_time_close_to_five_years(nextUpdate)
@@ -179,7 +179,7 @@ describe Puppet::SSL::CertificateRevocationList do
     end
 
     it "adds a non-critical CRL reason specifying key compromise by default" do
-      # http://tools.ietf.org/html/rfc5280#section-5.3.1
+      # https://tools.ietf.org/html/rfc5280#section-5.3.1
       serial = 1
       @crl.revoke(serial, @key)
 

data/spec/unit/ssl/certificate_spec.rb

@@ -162,7 +162,7 @@ describe Puppet::SSL::Certificate do
 
     it "should be able to read certificates from disk" do
       path = "/my/path"
-      File.expects(:read).with(path).returns("my certificate")
+      Puppet::FileSystem.expects(:read).with(path, :encoding => Encoding::ASCII).returns("my certificate")
       certificate = mock 'certificate'
       OpenSSL::X509::Certificate.expects(:new).with("my certificate").returns(certificate)
       expect(@certificate.read(path)).to equal(certificate)

data/spec/unit/ssl/configuration_spec.rb

@@ -9,6 +9,13 @@ describe Puppet::SSL::Configuration do
 
   let(:ssl_server_ca_auth) { "/path/to/certs/ssl_server_ca_auth.pem" }
 
+  # different UTF-8 widths
+  # 1-byte A
+  # 2-byte ۿ - http://www.fileformat.info/info/unicode/char/06ff/index.htm - 0xDB 0xBF / 219 191
+  # 3-byte ᚠ - http://www.fileformat.info/info/unicode/char/16A0/index.htm - 0xE1 0x9A 0xA0 / 225 154 160
+  # 4-byte 𠜎 - http://www.fileformat.info/info/unicode/char/2070E/index.htm - 0xF0 0xA0 0x9C 0x8E / 240 160 156 142
+  let (:mixed_utf8) { "A\u06FF\u16A0\u{2070E}" } # Aۿᚠ𠜎
+
   it "should require the localcacert argument" do
     expect { subject }.to raise_error ArgumentError
   end
@@ -44,8 +51,7 @@ describe Puppet::SSL::Configuration do
     end
 
     it "#ca_auth_certificates returns an Array<OpenSSL::X509::Certificate>" do
-      subject.stubs(:read_file).returns(master_ca_pem + root_ca_pem)
-
+      Puppet::FileSystem.expects(:read).with(subject.ca_auth_file, :encoding => Encoding::UTF_8).returns(master_ca_pem + root_ca_pem)
       certs = subject.ca_auth_certificates
       certs.each { |cert| expect(cert).to be_a_kind_of OpenSSL::X509::Certificate }
     end
@@ -67,6 +73,7 @@ describe Puppet::SSL::Configuration do
   # certificates.  It is signed by the Root CA.
   def master_ca_pem
     @master_ca_pem ||= <<-AUTH_BUNDLE
+# Master CA #{mixed_utf8}
 -----BEGIN CERTIFICATE-----
 MIICljCCAf+gAwIBAgIBAjANBgkqhkiG9w0BAQUFADBJMRAwDgYDVQQDDAdSb290
 IENBMRowGAYDVQQLDBFTZXJ2ZXIgT3BlcmF0aW9uczEZMBcGA1UECgwQRXhhbXBs
@@ -89,6 +96,7 @@ l1k75xLLIcrlsDYo3999KOSSchH2K7bLT7TuQ2okdP6FHWmeWmudewlu
   # This is the Root CA
   def root_ca_pem
     @root_ca_pem ||= <<-LOCALCACERT
+# Root CA #{mixed_utf8}
 -----BEGIN CERTIFICATE-----
 MIICYDCCAcmgAwIBAgIJALf2Pk2HvtBzMA0GCSqGSIb3DQEBBQUAMEkxEDAOBgNV
 BAMMB1Jvb3QgQ0ExGjAYBgNVBAsMEVNlcnZlciBPcGVyYXRpb25zMRkwFwYDVQQK
@@ -111,6 +119,7 @@ rPsNU/Tx19jHC87oXlmAePLI4IaUHXrWb7CRbY9TEcPdmj1R
   # signed by the Root CA.
   def agent_ca_pem
     @agent_ca_pem ||= <<-AGENT_CA
+# Agent CA #{mixed_utf8}
 -----BEGIN CERTIFICATE-----
 MIIClTCCAf6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBJMRAwDgYDVQQDDAdSb290
 IENBMRowGAYDVQQLDBFTZXJ2ZXIgT3BlcmF0aW9uczEZMBcGA1UECgwQRXhhbXBs

data/spec/unit/ssl/host_spec.rb

@@ -4,10 +4,10 @@ require 'spec_helper'
 require 'puppet/ssl/host'
 require 'matchers/json'
 
-def base_pson_comparison(result, pson_hash)
-  expect(result["fingerprint"]).to eq(pson_hash["fingerprint"])
-  expect(result["name"]).to        eq(pson_hash["name"])
-  expect(result["state"]).to       eq(pson_hash["desired_state"])
+def base_json_comparison(result, json_hash)
+  expect(result["fingerprint"]).to eq(json_hash["fingerprint"])
+  expect(result["name"]).to        eq(json_hash["name"])
+  expect(result["state"]).to       eq(json_hash["desired_state"])
 end
 
 describe Puppet::SSL::Host do
@@ -422,7 +422,7 @@ describe Puppet::SSL::Host do
       @key.stubs(:generate)
       Puppet::SSL::Key.indirection.expects(:save).raises "eh"
 
-      expect { @host.generate_key }.to raise_error
+      expect { @host.generate_key }.to raise_error(RuntimeError)
       expect(@host.key).to be_nil
     end
 
@@ -496,7 +496,7 @@ describe Puppet::SSL::Host do
       Puppet::SSL::CertificateRequest.indirection.expects(:prepare).returns(terminus)
       terminus.expects(:save).with { |req| req.instance == @request && req.key == "myname" }.raises "eh"
 
-      expect { @host.generate_certificate_request }.to raise_error
+      expect { @host.generate_certificate_request }.to raise_error(RuntimeError)
 
       expect(@host.instance_eval { @certificate_request }).to be_nil
     end
@@ -649,7 +649,7 @@ describe Puppet::SSL::Host do
       it "should use the CA to sign its certificate request if it does not have a certificate" do
         @host.expects(:certificate).returns nil
 
-        @ca.expects(:sign).with(@host.name, true)
+        @ca.expects(:sign).with(@host.name, {allow_dns_alt_names: true})
 
         @host.generate
       end
@@ -807,7 +807,7 @@ describe Puppet::SSL::Host do
     end
   end
 
-  describe "when handling PSON", :unless => Puppet.features.microsoft_windows? do
+  describe "when handling JSON", :unless => Puppet.features.microsoft_windows? do
     include PuppetSpec::Files
 
     before do
@@ -821,12 +821,12 @@ describe Puppet::SSL::Host do
       @ca=Puppet::SSL::CertificateAuthority.new
     end
 
-    describe "when converting to PSON" do
+    describe "when converting to JSON" do
       let(:host) do
         Puppet::SSL::Host.new("bazinga")
       end
 
-      let(:pson_hash) do
+      let(:json_hash) do
         {
           "fingerprint"   => host.certificate_request.fingerprint,
           "desired_state" => 'requested',
@@ -837,15 +837,15 @@ describe Puppet::SSL::Host do
       it "should be able to identify a host with an unsigned certificate request" do
         host.generate_certificate_request
 
-        result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
+        result = JSON.parse(Puppet::SSL::Host.new(host.name).to_json)
 
-        base_pson_comparison result, pson_hash
+        base_json_comparison result, json_hash
       end
 
       it "should validate against the schema" do
         host.generate_certificate_request
 
-        expect(host.to_pson).to validate_against('api/schemas/host.json')
+        expect(host.to_json).to validate_against('api/schemas/host.json')
       end
 
       describe "explicit fingerprints" do
@@ -853,12 +853,12 @@ describe Puppet::SSL::Host do
           it "should include #{md}" do
             mds = md.to_s
             host.generate_certificate_request
-            pson_hash["fingerprints"] = {}
-            pson_hash["fingerprints"][mds] = host.certificate_request.fingerprint(md)
+            json_hash["fingerprints"] = {}
+            json_hash["fingerprints"][mds] = host.certificate_request.fingerprint(md)
 
-            result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
-            base_pson_comparison result, pson_hash
-            expect(result["fingerprints"][mds]).to eq(pson_hash["fingerprints"][mds])
+            result = JSON.parse(Puppet::SSL::Host.new(host.name).to_json)
+            base_json_comparison result, json_hash
+            expect(result["fingerprints"][mds]).to eq(json_hash["fingerprints"][mds])
           end
         end
       end
@@ -867,11 +867,11 @@ describe Puppet::SSL::Host do
         describe "when not specified" do
           it "should include the dns_alt_names associated with the certificate" do
             host.generate_certificate_request
-            pson_hash["desired_alt_names"] = host.certificate_request.subject_alt_names
+            json_hash["desired_alt_names"] = host.certificate_request.subject_alt_names
 
-            result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
-            base_pson_comparison result, pson_hash
-            expect(result["dns_alt_names"]).to eq(pson_hash["desired_alt_names"])
+            result = JSON.parse(Puppet::SSL::Host.new(host.name).to_json)
+            base_json_comparison result, json_hash
+            expect(result["dns_alt_names"]).to eq(json_hash["desired_alt_names"])
           end
         end
 
@@ -884,15 +884,15 @@ describe Puppet::SSL::Host do
             end
 
             it "should include the dns_alt_names associated with the certificate" do
-              pson_hash["desired_alt_names"] = host.certificate_request.subject_alt_names
+              json_hash["desired_alt_names"] = host.certificate_request.subject_alt_names
 
-              result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
-              base_pson_comparison result, pson_hash
-              expect(result["dns_alt_names"]).to eq(pson_hash["desired_alt_names"])
+              result = JSON.parse(Puppet::SSL::Host.new(host.name).to_json)
+              base_json_comparison result, json_hash
+              expect(result["dns_alt_names"]).to eq(json_hash["desired_alt_names"])
             end
 
             it "should validate against the schema" do
-              expect(host.to_pson).to validate_against('api/schemas/host.json')
+              expect(host.to_json).to validate_against('api/schemas/host.json')
             end
           end
         end
@@ -901,37 +901,37 @@ describe Puppet::SSL::Host do
       it "should be able to identify a host with a signed certificate" do
         host.generate_certificate_request
         @ca.sign(host.name)
-        pson_hash = {
+        json_hash = {
           "fingerprint"          => Puppet::SSL::Certificate.indirection.find(host.name).fingerprint,
           "desired_state"        => 'signed',
           "name"                 => host.name,
         }
 
-        result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
-        base_pson_comparison result, pson_hash
+        result = JSON.parse(Puppet::SSL::Host.new(host.name).to_json)
+        base_json_comparison result, json_hash
       end
 
       it "should be able to identify a host with a revoked certificate" do
         host.generate_certificate_request
         @ca.sign(host.name)
         @ca.revoke(host.name)
-        pson_hash["fingerprint"] = Puppet::SSL::Certificate.indirection.find(host.name).fingerprint
-        pson_hash["desired_state"] = 'revoked'
+        json_hash["fingerprint"] = Puppet::SSL::Certificate.indirection.find(host.name).fingerprint
+        json_hash["desired_state"] = 'revoked'
 
-        result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
-        base_pson_comparison result, pson_hash
+        result = JSON.parse(Puppet::SSL::Host.new(host.name).to_json)
+        base_json_comparison result, json_hash
       end
     end
 
-    describe "when converting from PSON" do
+    describe "when converting from JSON" do
       it "should return a Puppet::SSL::Host object with the specified desired state" do
         host = Puppet::SSL::Host.new("bazinga")
         host.desired_state="signed"
-        pson_hash = {
+        json_hash = {
           "name"  => host.name,
           "desired_state" => host.desired_state,
         }
-        generated_host = Puppet::SSL::Host.from_data_hash(pson_hash)
+        generated_host = Puppet::SSL::Host.from_data_hash(json_hash)
         expect(generated_host.desired_state).to eq(host.desired_state)
         expect(generated_host.name).to eq(host.name)
       end