puppet 4.1.0 → 5.0.0

data/lib/puppet/ssl/base.rb

@@ -29,7 +29,7 @@ class Puppet::SSL::Base
   end
 
   def self.validate_certname(name)
-    raise "Certname #{name.inspect} must not contain unprintable or non-ASCII characters" unless name =~ VALID_CERTNAME
+    raise _("Certname %{name} must not contain unprintable or non-ASCII characters") % { name: name.inspect } unless name =~ VALID_CERTNAME
   end
 
   attr_accessor :name, :content
@@ -81,7 +81,20 @@ class Puppet::SSL::Base
 
   # Read content from disk appropriately.
   def read(path)
-    @content = wrapped_class.new(File.read(path))
+    # applies to Puppet::SSL::Certificate, Puppet::SSL::CertificateRequest, Puppet::SSL::CertificateRevocationList
+    # Puppet::SSL::Key uses this, but also provides its own override
+    # nothing derives from Puppet::SSL::Certificate, but it is called by a number of other SSL Indirectors:
+    # Puppet::SSL::Certificate::DisabledCa (:find, :save, :destroy)
+    # Puppet::Indirector::CertificateStatus::File (.indirection.find)
+    # Puppet::Network::HTTP::WEBrick (.indirection.find)
+    # Puppet::Network::HTTP::RackREST (.from_instance)
+    # Puppet::Network::HTTP::WEBrickREST (.from_instance)
+    # Puppet::SSL::CertificateAuthority (.new, .indirection.find, .indirection.save)
+    # Puppet::SSL::Host (.indirection.find)
+    # Puppet::SSL::Inventory (.indirection.search, implements its own add / rebuild / serials with encoding UTF8)
+    # Puppet::SSL::CertificateAuthority::Interface (.indirection.find)
+    # Puppet::SSL::Validator::DefaultValidator (.from_instance) / Puppet::SSL::Validator::NoValidator does nothing
+    @content = wrapped_class.new(Puppet::FileSystem.read(path, :encoding => Encoding::ASCII))
   end
 
   # Convert our thing to pem.
@@ -128,7 +141,7 @@ class Puppet::SSL::Base
     if match = digest_re.match(ln)
       match[0].downcase
     else
-      raise Puppet::Error, "Unknown signature algorithm '#{ln}'"
+      raise Puppet::Error, _("Unknown signature algorithm '%{ln}'") % { ln: ln }
     end
   end
 

data/lib/puppet/ssl/certificate.rb

@@ -69,7 +69,7 @@ DOC
     # is where the extensions are stored."
     @extensions_tag ||= 3
 
-    @exts_seq ||= OpenSSL::ASN1.decode(content.to_der).value[0].find do |data|
+    @exts_seq ||= OpenSSL::ASN1.decode(content.to_der).value[0].value.find do |data|
       (data.tag == @extensions_tag) && (data.tag_class == :CONTEXT_SPECIFIC)
     end.value[0]
   end

data/lib/puppet/ssl/certificate_authority/interface.rb

@@ -8,6 +8,9 @@ module Puppet
         DESTRUCTIVE_METHODS = [:destroy, :revoke]
         SUBJECTLESS_METHODS = [:list, :reinventory]
 
+        CERT_STATUS_GLYPHS = {:signed => '+', :request => ' ', :invalid => '-'}
+        VALID_CONFIRMATION_VALUES = %w{y Y yes Yes YES}
+
         class InterfaceError < ArgumentError; end
 
         attr_reader :method, :subjects, :digest, :options
@@ -15,13 +18,13 @@ module Puppet
         # Actually perform the work.
         def apply(ca)
           unless subjects || SUBJECTLESS_METHODS.include?(method)
-            raise ArgumentError, "You must provide hosts or --all when using #{method}"
+            raise ArgumentError, _("You must provide hosts or --all when using %{method}") % { method: method }
           end
 
           destructive_subjects = [:signed, :all].include?(subjects)
           if DESTRUCTIVE_METHODS.include?(method) && destructive_subjects
-            subject_text = (subjects == :all ? subjects : "all signed")
-            raise ArgumentError, "Refusing to #{method} #{subject_text} certs, provide an explicit list of certs to #{method}"
+            subject_text = (subjects == :all ? subjects : _("all signed"))
+            raise ArgumentError, _("Refusing to %{method} %{subject_text} certs, provide an explicit list of certs to %{method}") % { method: method, subject_text: subject_text }
           end
 
           # if the interface implements the method, use it instead of the ca's method
@@ -35,7 +38,7 @@ module Puppet
         end
 
         def generate(ca)
-          raise InterfaceError, "It makes no sense to generate all hosts; you must specify a list" if subjects == :all
+          raise InterfaceError, _("It makes no sense to generate all hosts; you must specify a list") if subjects == :all
 
           subjects.each do |host|
             ca.generate(host, options)
@@ -71,19 +74,30 @@ module Puppet
           return if hosts.empty?
 
           hosts.uniq.sort.each do |host|
+            verify_error = nil
+
             begin
               ca.verify(host) unless requests.include?(host)
             rescue Puppet::SSL::CertificateAuthority::CertificateVerificationError => details
-              verify_error = details.to_s
+              verify_error = "(#{details.to_s})"
             end
 
             if verify_error
-              certs[:invalid][host] = [ Puppet::SSL::Certificate.indirection.find(host), verify_error ]
+              type = :invalid
+              cert = Puppet::SSL::Certificate.indirection.find(host)
             elsif (signed and signed.include?(host))
-              certs[:signed][host]  = Puppet::SSL::Certificate.indirection.find(host)
+              type = :signed
+              cert = Puppet::SSL::Certificate.indirection.find(host)
             else
-              certs[:request][host] = Puppet::SSL::CertificateRequest.indirection.find(host)
+              type = :request
+              cert = Puppet::SSL::CertificateRequest.indirection.find(host)
             end
+
+            certs[type][host] = {
+              :cert         => cert,
+              :type         => type,
+              :verify_error => verify_error,
+            }
           end
 
           names = certs.values.map(&:keys).flatten
@@ -95,37 +109,133 @@ module Puppet
           output = [:request, :signed, :invalid].map do |type|
             next if certs[type].empty?
 
-            certs[type].map do |host,info|
-              format_host(ca, host, type, info, name_width)
+            certs[type].map do |host, info|
+              format_host(host, info, name_width, options[:format])
             end
           end.flatten.compact.sort.join("\n")
 
           puts output
         end
 
-        def format_host(ca, host, type, info, width)
-          cert, verify_error = info
-          alt_names = case type
-                      when :signed
-                        cert.subject_alt_names
-                      when :request
-                        cert.subject_alt_names
-                      else
-                        []
-                      end
+        def format_host(host, info, width, format)
+          case format
+          when :machine
+            machine_host_formatting(host, info)
+          when :human
+            human_host_formatting(host, info)
+          else
+            if options[:verbose]
+              machine_host_formatting(host, info)
+            else
+              legacy_host_formatting(host, info, width)
+            end
+          end
+        end
+
+        def machine_host_formatting(host, info)
+          type         = info[:type]
+          verify_error = info[:verify_error]
+          cert         = info[:cert]
+          alt_names    = cert.subject_alt_names - [host]
+          extensions   = format_attrs_and_exts(cert)
+
+          glyph       = CERT_STATUS_GLYPHS[type]
+          name        = host.inspect
+          fingerprint = cert.digest(@digest).to_s
+
+          expiration  = cert.expiration.iso8601 if type == :signed
+
+          if type != :invalid
+            if !alt_names.empty?
+              extensions.unshift("alt names: #{alt_names.map(&:inspect).join(', ')}")
+            end
+
+            if !extensions.empty?
+              metadata_string = "(#{extensions.join(', ')})" unless extensions.empty?
+            end
+          end
+
+          [glyph, name, fingerprint, expiration, metadata_string, verify_error].compact.join(' ')
+        end
+
+        def human_host_formatting(host, info)
+          type         = info[:type]
+          verify_error = info[:verify_error]
+          cert         = info[:cert]
+          alt_names    = cert.subject_alt_names - [host]
+          extensions   = format_attrs_and_exts(cert)
+
+          glyph       = CERT_STATUS_GLYPHS[type]
+          fingerprint = cert.digest(@digest).to_s
+
+          if type == :invalid || (extensions.empty? && alt_names.empty?)
+            extension_string = ''
+          else
+            if !alt_names.empty?
+              extensions.unshift("alt names: #{alt_names.map(&:inspect).join(', ')}")
+            end
+
+            extension_string = "\n    Extensions:\n      "
+            extension_string << extensions.join("\n      ")
+          end
 
-          alt_names.delete(host)
+          if type == :signed
+            expiration_string = "\n    Expiration: #{cert.expiration.iso8601}"
+          else
+            expiration_string = ''
+          end
 
-          alt_str = "(alt names: #{alt_names.map(&:inspect).join(', ')})" unless alt_names.empty?
+          status = case type
+                   when :invalid then "Invalid - #{verify_error}"
+                   when :request then "Request Pending"
+                   when :signed then "Signed"
+                   end
+
+          output = "#{glyph} #{host.inspect}"
+          output << "\n  #{fingerprint}"
+          output << "\n    Status: #{status}"
+          output << expiration_string
+          output << extension_string
+          output << "\n"
+
+          output
+        end
 
-          glyph = {:signed => '+', :request => ' ', :invalid => '-'}[type]
+        def legacy_host_formatting(host, info, width)
+          type         = info[:type]
+          verify_error = info[:verify_error]
+          cert         = info[:cert]
+          alt_names    = cert.subject_alt_names - [host]
+          extensions   = format_attrs_and_exts(cert)
 
-          name = host.inspect.ljust(width)
+          glyph       = CERT_STATUS_GLYPHS[type]
+          name        = host.inspect.ljust(width)
           fingerprint = cert.digest(@digest).to_s
 
-          explanation = "(#{verify_error})" if verify_error
+          if type != :invalid
+            if alt_names.empty?
+              alt_name_string = nil
+            else
+              alt_name_string = "(alt names: #{alt_names.map(&:inspect).join(', ')})"
+            end
+
+            if extensions.empty?
+              extension_string = nil
+            else
+              extension_string = "**"
+            end
+          end
 
-          [glyph, name, fingerprint, alt_str, explanation].compact.join(' ')
+          [glyph, name, fingerprint, alt_name_string, verify_error, extension_string].compact.join(' ')
+        end
+
+        def format_attrs_and_exts(cert)
+          exts = []
+          exts += cert.custom_extensions if cert.respond_to?(:custom_extensions)
+          exts += cert.custom_attributes if cert.respond_to?(:custom_attributes)
+          exts += cert.request_extensions if cert.respond_to?(:request_extensions)
+
+          exts.map {|e| "#{e['oid']}: #{e['value'].inspect}" }.sort
         end
 
         # Set the method to apply.
@@ -140,7 +250,7 @@ module Puppet
             if value = ca.print(host)
               puts value
             else
-              Puppet.err "Could not find certificate for #{host}"
+              raise ArgumentError, _("Could not find certificate for %{host}") % { host: host }
             end
           end
         end
@@ -151,17 +261,47 @@ module Puppet
             if cert = (Puppet::SSL::Certificate.indirection.find(host) || Puppet::SSL::CertificateRequest.indirection.find(host))
               puts "#{host} #{cert.digest(@digest)}"
             else
-              Puppet.err "Could not find certificate for #{host}"
+	      raise ArgumentError, _("Could not find certificate for %{host}") % { host: host }
             end
           end
         end
 
-        # Signs given certificates or waiting of subjects == :all
+        # Signs given certificates or all waiting if subjects == :all
         def sign(ca)
           list = subjects == :all ? ca.waiting? : subjects
-          raise InterfaceError, "No waiting certificate requests to sign" if list.empty?
+          raise InterfaceError, _("No waiting certificate requests to sign") if list.empty?
+
+          signing_options = options.select { |k,_|
+            [:allow_authorization_extensions, :allow_dns_alt_names].include?(k)
+          }
+
           list.each do |host|
-            ca.sign(host, options[:allow_dns_alt_names])
+            cert = Puppet::SSL::CertificateRequest.indirection.find(host)
+
+            raise InterfaceError, _("Could not find CSR for: %{host}.") % { host: host.inspect } unless cert
+
+            # ca.sign will also do this - and it should if it is called
+            # elsewhere - but we want to reject an attempt to sign a
+            # problematic csr as early as possible for usability concerns.
+            ca.check_internal_signing_policies(host, cert, signing_options)
+
+            name_width = host.inspect.length
+            info = {:type => :request, :cert => cert}
+            host_string = format_host(host, info, name_width, options[:format])
+            puts _("Signing Certificate Request for:\n%{host_string}") % { host_string: host_string }
+
+            if options[:interactive]
+              STDOUT.print _("Sign Certificate Request? [y/N] ")
+
+              if !options[:yes]
+                input = STDIN.gets.chomp
+                raise InterfaceError, _("NOT Signing Certificate Request") unless VALID_CONFIRMATION_VALUES.include?(input)
+              else
+                puts _("Assuming YES from `-y' or `--assume-yes' flag")
+              end
+            end
+
+            ca.sign(host, signing_options)
           end
         end
 
@@ -172,7 +312,7 @@ module Puppet
         # Set the list of hosts we're operating on.  Also supports keywords.
         def subjects=(value)
           unless value == :all || value == :signed || value.is_a?(Array)
-            raise ArgumentError, "Subjects must be an array or :all; not #{value}"
+            raise ArgumentError, _("Subjects must be an array or :all; not %{value}") % { value: value }
           end
 
           @subjects = (value == []) ? nil : value

data/lib/puppet/ssl/certificate_authority.rb

@@ -66,7 +66,7 @@ class Puppet::SSL::CertificateAuthority
   # @api private
   def autosign(csr)
     if autosign?(csr)
-      Puppet.info "Autosigning #{csr.name}"
+      Puppet.info _("Autosigning %{csr}") % { csr: csr.name }
       sign(csr.name)
     end
   end
@@ -118,7 +118,7 @@ class Puppet::SSL::CertificateAuthority
   # Generates a new certificate.
   # @return Puppet::SSL::Certificate
   def generate(name, options = {})
-    raise ArgumentError, "A Certificate already exists for #{name}" if Puppet::SSL::Certificate.indirection.find(name)
+    raise ArgumentError, _("A Certificate already exists for %{name}") % { name: name } if Puppet::SSL::Certificate.indirection.find(name)
 
     # Pass on any requested subjectAltName field.
     san = options[:dns_alt_names]
@@ -127,7 +127,7 @@ class Puppet::SSL::CertificateAuthority
     host.generate_certificate_request(:dns_alt_names => san)
     # CSR may have been implicitly autosigned, generating a certificate
     # Or sign explicitly
-    host.certificate || sign(name, !!san)
+    host.certificate || sign(name, {allow_dns_alt_names: !!san})
   end
 
   # Generate our CA certificate.
@@ -145,7 +145,8 @@ class Puppet::SSL::CertificateAuthority
     request.generate(host.key)
 
     # Create a self-signed certificate.
-    @certificate = sign(host.name, false, request)
+    @certificate = sign(host.name, {allow_dns_alt_names: false,
+                                    self_signing_csr: request})
 
     # And make sure we initialize our CRL.
     crl
@@ -172,9 +173,10 @@ class Puppet::SSL::CertificateAuthority
     20.times { pass += (rand(74) + 48).chr }
 
     begin
-      Puppet.settings.setting(:capass).open('w') { |f| f.print pass }
+      # random password is limited to ASCII characters 48 ('0') through 122 ('z')
+      Puppet.settings.setting(:capass).open('w:ASCII') { |f| f.print pass }
     rescue Errno::EACCES => detail
-      raise Puppet::Error, "Could not write CA password: #{detail}", detail.backtrace
+      raise Puppet::Error, _("Could not write CA password: %{detail}") % { detail: detail }, detail.backtrace
     end
 
     @password = pass
@@ -188,7 +190,7 @@ class Puppet::SSL::CertificateAuthority
   #
   # @return [Array<String>]
   def list(name='*')
-    list_certificates(name).collect { |c| c.name }
+    Puppet::SSL::Certificate.indirection.search(name).collect { |c| c.name }
   end
 
   # Return all the certificate objects as found by the indirector
@@ -204,7 +206,10 @@ class Puppet::SSL::CertificateAuthority
   # @param name [Array<string>] filter to cerificate names
   #
   # @return [Array<Puppet::SSL::Certificate>]
+  #
+  # @deprecated Use Puppet::SSL::CertificateAuthority#list or Puppet Server Certificate status API
   def list_certificates(name='*')
+    Puppet.deprecation_warning(_("Puppet::SSL::CertificateAuthority#list_certificates is deprecated. Please use Puppet::SSL::CertificateAuthority#list or the certificate status API to query certificate information. See https://docs.puppet.com/puppet/latest/http_api/http_certificate_status.html"))
     Puppet::SSL::Certificate.indirection.search(name)
   end
 
@@ -212,7 +217,8 @@ class Puppet::SSL::CertificateAuthority
   # file so this one is considered used.
   def next_serial
     serial = 1
-    Puppet.settings.setting(:serial).exclusive_open('a+') do |f|
+    # the serial is 4 hex digits - limited to ASCII
+    Puppet.settings.setting(:serial).exclusive_open('a+:ASCII') do |f|
       f.rewind
       serial = f.read.chomp.hex
       if serial == 0
@@ -241,7 +247,7 @@ class Puppet::SSL::CertificateAuthority
 
   # Revoke a given certificate.
   def revoke(name)
-    raise ArgumentError, "Cannot revoke certificates when the CRL is disabled" unless crl
+    raise ArgumentError, _("Cannot revoke certificates when the CRL is disabled") unless crl
 
     cert = Puppet::SSL::Certificate.indirection.find(name)
 
@@ -254,7 +260,7 @@ class Puppet::SSL::CertificateAuthority
               end
 
     if serials.empty?
-      raise ArgumentError, "Could not find a serial number for #{name}"
+      raise ArgumentError, _("Could not find a serial number for %{name}") % { name: name }
     end
 
     serials.each do |s|
@@ -271,8 +277,13 @@ class Puppet::SSL::CertificateAuthority
   end
 
   # Sign a given certificate request.
-  def sign(hostname, allow_dns_alt_names = false, self_signing_csr = nil)
-    # This is a self-signed certificate
+  def sign(hostname, options={})
+    options[:allow_authorization_extensions] ||= false
+    options[:allow_dns_alt_names] ||= false
+    options[:self_signing_csr] ||= nil
+
+    self_signing_csr = options.delete(:self_signing_csr)
+
     if self_signing_csr
       # # This is a self-signed certificate, which is for the CA.  Since this
       # # forces the certificate to be self-signed, anyone who manages to trick
@@ -282,9 +293,8 @@ class Puppet::SSL::CertificateAuthority
       cert_type = :ca
       issuer = csr.content
     else
-      allow_dns_alt_names = true if hostname == Puppet[:certname].downcase
       unless csr = Puppet::SSL::CertificateRequest.indirection.find(hostname)
-        raise ArgumentError, "Could not find certificate request for #{hostname}"
+        raise ArgumentError, _("Could not find certificate request for %{hostname}") % { hostname: hostname }
       end
 
       cert_type = :server
@@ -292,8 +302,8 @@ class Puppet::SSL::CertificateAuthority
 
       # Make sure that the CSR conforms to our internal signing policies.
       # This will raise if the CSR doesn't conform, but just in case...
-      check_internal_signing_policies(hostname, csr, allow_dns_alt_names) or
-        raise CertificateSigningError.new(hostname), "CSR had an unknown failure checking internal signing policies, will not sign!"
+      check_internal_signing_policies(hostname, csr, options) or
+        raise CertificateSigningError.new(hostname), _("CSR had an unknown failure checking internal signing policies, will not sign!")
     end
 
     cert = Puppet::SSL::Certificate.new(hostname)
@@ -303,7 +313,7 @@ class Puppet::SSL::CertificateAuthority
     signer = Puppet::SSL::CertificateSigner.new
     signer.sign(cert.content, host.key.content)
 
-    Puppet.notice "Signed certificate request for #{hostname}"
+    Puppet.notice _("Signed certificate request for %{hostname}") % { hostname: hostname }
 
     # Add the cert to the inventory before we save it, since
     # otherwise we could end up with it being duplicated, if
@@ -320,27 +330,33 @@ class Puppet::SSL::CertificateAuthority
     cert
   end
 
-  def check_internal_signing_policies(hostname, csr, allow_dns_alt_names)
+  def check_internal_signing_policies(hostname, csr, options = {})
+    options[:allow_authorization_extensions] ||= false
+    options[:allow_dns_alt_names] ||= false
+    # This allows for masters to bootstrap themselves in certain scenarios
+    options[:allow_dns_alt_names] = true if hostname == Puppet[:certname].downcase
+
     # Reject unknown request extensions.
     unknown_req = csr.request_extensions.reject do |x|
       RequestExtensionWhitelist.include? x["oid"] or
         Puppet::SSL::Oids.subtree_of?('ppRegCertExt', x["oid"], true) or
-        Puppet::SSL::Oids.subtree_of?('ppPrivCertExt', x["oid"], true)
+        Puppet::SSL::Oids.subtree_of?('ppPrivCertExt', x["oid"], true) or
+        Puppet::SSL::Oids.subtree_of?('ppAuthCertExt', x["oid"], true)
     end
 
     if unknown_req and not unknown_req.empty?
       names = unknown_req.map {|x| x["oid"] }.sort.uniq.join(", ")
-      raise CertificateSigningError.new(hostname), "CSR has request extensions that are not permitted: #{names}"
+      raise CertificateSigningError.new(hostname), _("CSR has request extensions that are not permitted: %{names}") % { names: names }
     end
 
     # Do not sign misleading CSRs
     cn = csr.content.subject.to_a.assoc("CN")[1]
     if hostname != cn
-      raise CertificateSigningError.new(hostname), "CSR subject common name #{cn.inspect} does not match expected certname #{hostname.inspect}"
+      raise CertificateSigningError.new(hostname), _("CSR subject common name %{name} does not match expected certname %{expected}") % { name: cn.inspect, expected: hostname.inspect }
     end
 
     if hostname !~ Puppet::SSL::Base::VALID_CERTNAME
-      raise CertificateSigningError.new(hostname), "CSR #{hostname.inspect} subject contains unprintable or non-ASCII characters"
+      raise CertificateSigningError.new(hostname), _("CSR %{hostname} subject contains unprintable or non-ASCII characters") % { hostname: hostname.inspect }
     end
 
     # Wildcards: we don't allow 'em at any point.
@@ -349,29 +365,41 @@ class Puppet::SSL::CertificateAuthority
     # to scrobble through the content of the CSR subject field to make sure it
     # is what we expect where we expect it.
     if csr.content.subject.to_s.include? '*'
-      raise CertificateSigningError.new(hostname), "CSR subject contains a wildcard, which is not allowed: #{csr.content.subject.to_s}"
+      raise CertificateSigningError.new(hostname), _("CSR subject contains a wildcard, which is not allowed: %{subject}") % { subject: csr.content.subject.to_s }
     end
 
     unless csr.content.verify(csr.content.public_key)
-      raise CertificateSigningError.new(hostname), "CSR contains a public key that does not correspond to the signing key"
+      raise CertificateSigningError.new(hostname), _("CSR contains a public key that does not correspond to the signing key")
+    end
+
+    auth_extensions = csr.request_extensions.select do |extension|
+      Puppet::SSL::Oids.subtree_of?('ppAuthCertExt', extension['oid'], true)
+    end
+
+    if auth_extensions.any? && !options[:allow_authorization_extensions]
+      ext_names = auth_extensions.map do |extension|
+        extension['oid']
+      end
+
+      raise CertificateSigningError.new(hostname), _("CSR '%{csr}' contains authorization extensions (%{extensions}), which are disallowed by default. Use `puppet cert --allow-authorization-extensions sign %{csr}` to sign this request.") % { csr: csr.name, extensions: ext_names.join(', ') }
     end
 
     unless csr.subject_alt_names.empty?
       # If you alt names are allowed, they are required. Otherwise they are
       # disallowed. Self-signed certs are implicitly trusted, however.
-      unless allow_dns_alt_names
-        raise CertificateSigningError.new(hostname), "CSR '#{csr.name}' contains subject alternative names (#{csr.subject_alt_names.join(', ')}), which are disallowed. Use `puppet cert --allow-dns-alt-names sign #{csr.name}` to sign this request."
+      unless options[:allow_dns_alt_names]
+        raise CertificateSigningError.new(hostname), _("CSR '%{csr}' contains subject alternative names (%{alt_names}), which are disallowed. Use `puppet cert --allow-dns-alt-names sign %{csr}` to sign this request.") % { csr: csr.name, alt_names: csr.subject_alt_names.join(', ') }
       end
 
       # If subjectAltNames are present, validate that they are only for DNS
       # labels, not any other kind.
       unless csr.subject_alt_names.all? {|x| x =~ /^DNS:/ }
-        raise CertificateSigningError.new(hostname), "CSR '#{csr.name}' contains a subjectAltName outside the DNS label space: #{csr.subject_alt_names.join(', ')}.  To continue, this CSR needs to be cleaned."
+        raise CertificateSigningError.new(hostname), _("CSR '%{csr}' contains a subjectAltName outside the DNS label space: %{alt_names}.  To continue, this CSR needs to be cleaned.") % { csr: csr.name, alt_names: csr.subject_alt_names.join(', ') }
       end
 
       # Check for wildcards in the subjectAltName fields too.
       if csr.subject_alt_names.any? {|x| x.include? '*' }
-        raise CertificateSigningError.new(hostname), "CSR '#{csr.name}' subjectAltName contains a wildcard, which is not allowed: #{csr.subject_alt_names.join(', ')}  To continue, this CSR needs to be cleaned."
+        raise CertificateSigningError.new(hostname), _("CSR '%{csr}' subjectAltName contains a wildcard, which is not allowed: %{alt_names}  To continue, this CSR needs to be cleaned.") % { csr: csr.name, alt_names: csr.subject_alt_names.join(', ') }
       end
     end
 
@@ -394,6 +422,11 @@ class Puppet::SSL::CertificateAuthority
   #   of the X509 Store
   #
   # @return [OpenSSL::X509::Store]
+  #
+  # @deprecated Strictly speaking, #x509_store is marked API private, so we
+  #   don't need to publicly deprecate it. But it marked as deprecated here to
+  #   avoid the exceedingly small chance that someone comes in and uses it from
+  #   within this class before it is removed.
   def x509_store(options = {})
     if (options[:cache])
       return @x509store unless @x509store.nil?
@@ -441,7 +474,10 @@ class Puppet::SSL::CertificateAuthority
   # @param cert [Puppet::SSL::Certificate] the certificate to check validity of
   #
   # @return [Boolean] true if signed, false if unsigned or revoked
+  #
+  # @deprecated use Puppet::SSL::CertificateAuthority#verify or Puppet Server certificate status API
   def certificate_is_alive?(cert)
+    Puppet.deprecation_warning(_("Puppet::SSL::CertificateAuthority#certificate_is_alive? is deprecated. Please use Puppet::SSL::CertificateAuthority#verify or the certificate status API to query certificate information. See https://docs.puppet.com/puppet/latest/http_api/http_certificate_status.html"))
     x509_store(:cache => true).verify(cert.content)
   end
 
@@ -458,16 +494,16 @@ class Puppet::SSL::CertificateAuthority
   # @return [Boolean] true if signed, there are no cases where false is returned
   def verify(name)
     unless cert = Puppet::SSL::Certificate.indirection.find(name)
-      raise ArgumentError, "Could not find a certificate for #{name}"
+      raise ArgumentError, _("Could not find a certificate for %{name}") % { name: name }
     end
-    store = x509_store
+    store = create_x509_store
 
     raise CertificateVerificationError.new(store.error), store.error_string unless store.verify(cert.content)
   end
 
   def fingerprint(name, md = :SHA256)
     unless cert = Puppet::SSL::Certificate.indirection.find(name) || Puppet::SSL::CertificateRequest.indirection.find(name)
-      raise ArgumentError, "Could not find a certificate or csr for #{name}"
+      raise ArgumentError, _("Could not find a certificate or csr for %{name}") % { name: name }
     end
     cert.fingerprint(md)
   end

data/lib/puppet/ssl/certificate_factory.rb

@@ -28,9 +28,9 @@ module Puppet::SSL::CertificateFactory
     # Work out if we can even build the requested type of certificate.
     build_extensions = "build_#{cert_type.to_s}_extensions"
     respond_to?(build_extensions) or
-      raise ArgumentError, "#{cert_type.to_s} is an invalid certificate type!"
+      raise ArgumentError, _("%{cert_type} is an invalid certificate type!") % { cert_type: cert_type.to_s }
 
-    raise ArgumentError, "Certificate TTL must be an integer" unless ttl.nil? || ttl.is_a?(Fixnum)
+    raise ArgumentError, _("Certificate TTL must be an integer") unless ttl.nil? || ttl.is_a?(Integer)
 
     # set up the certificate, and start building the content.
     cert = OpenSSL::X509::Certificate.new
@@ -62,7 +62,7 @@ module Puppet::SSL::CertificateFactory
   #   extensions to.
   # @param csr [OpenSSL::X509::Request] The CSR associated with the given
   #   certificate, which may specify requested extensions for the given cert.
-  #   See http://tools.ietf.org/html/rfc2985 Section 5.4.2 Extension request
+  #   See https://tools.ietf.org/html/rfc2985 Section 5.4.2 Extension request
   # @param issuer [OpenSSL::X509::Certificate, OpenSSL::X509::Request] An X509 CSR
   #   if this is a self signed certificate, or the X509 certificate of the CA if
   #   this is a CA signed certificate.
@@ -100,7 +100,7 @@ module Puppet::SSL::CertificateFactory
     # something went wrong up there. --daniel 2011-10-11
     defaults = { "nsComment" => "Puppet Ruby/OpenSSL Internal Certificate" }
 
-    # See http://www.openssl.org/docs/apps/x509v3_config.html
+    # See https://www.openssl.org/docs/apps/x509v3_config.html
     # for information about the special meanings of 'hash', 'keyid', 'issuer'
     override = {
       "subjectKeyIdentifier"   => "hash",
@@ -126,7 +126,7 @@ module Puppet::SSL::CertificateFactory
       # complaint that the issuer keyid can't be fetched, which breaks all
       # sorts of things in our test suite and, e.g., bootstrapping the CA.
       #
-      # http://tools.ietf.org/html/rfc5280#section-4.2.1.1 says that, to be a
+      # https://tools.ietf.org/html/rfc5280#section-4.2.1.1 says that, to be a
       # conforming CA we MAY omit the field if we are self-signed, which I
       # think gives us a pass in the specific case.
       #