puppet 5.5.12 → 5.5.13

data/spec/unit/ssl/host_spec.rb

@@ -1,4 +1,3 @@
-#! /usr/bin/env ruby
 require 'spec_helper'
 
 require 'puppet/ssl/host'
@@ -37,11 +36,11 @@ describe Puppet::SSL::Host do
   end
 
   it "should retrieve its public key from its private key" do
-    realkey = mock 'realkey'
-    key = stub 'key', :content => realkey
-    Puppet::SSL::Key.indirection.stubs(:find).returns(key)
-    pubkey = mock 'public_key'
-    realkey.expects(:public_key).returns pubkey
+    realkey = double('realkey')
+    key = double('key', :content => realkey)
+    allow(Puppet::SSL::Key.indirection).to receive(:find).and_return(key)
+    pubkey = double('public_key')
+    expect(realkey).to receive(:public_key).and_return(pubkey)
 
     expect(@host.public_key).to equal(pubkey)
   end
@@ -51,7 +50,7 @@ describe Puppet::SSL::Host do
   end
 
   it "should be a ca host if its name matches the CA_NAME" do
-    Puppet::SSL::Host.stubs(:ca_name).returns "yayca"
+    allow(Puppet::SSL::Host).to receive(:ca_name).and_return("yayca")
     expect(Puppet::SSL::Host.new("yayca")).to be_ca
   end
 
@@ -78,11 +77,11 @@ describe Puppet::SSL::Host do
   end
 
   it "should generate the certificate for the localhost instance if no certificate is available" do
-    host = stub 'host', :key => nil
-    Puppet::SSL::Host.expects(:new).returns host
+    host = double('host', :key => nil)
+    expect(Puppet::SSL::Host).to receive(:new).and_return(host)
 
-    host.expects(:certificate).returns nil
-    host.expects(:generate)
+    expect(host).to receive(:certificate).and_return(nil)
+    expect(host).to receive(:generate)
 
     expect(Puppet::SSL::Host.localhost).to equal(host)
   end
@@ -92,7 +91,7 @@ describe Puppet::SSL::Host do
     Puppet[:confdir] = tmpdir('conf')
     Puppet[:dns_alt_names] = "foo,bar,baz"
     ca = Puppet::SSL::CertificateAuthority.new
-    Puppet::SSL::CertificateAuthority.stubs(:instance).returns ca
+    allow(Puppet::SSL::CertificateAuthority).to receive(:instance).and_return(ca)
 
     localhost = Puppet::SSL::Host.localhost
     cert = localhost.certificate
@@ -103,14 +102,14 @@ describe Puppet::SSL::Host do
 
   context "with dns_alt_names" do
     before :each do
-      @key = stub('key content')
-      key = stub('key', :generate => true, :content => @key)
-      Puppet::SSL::Key.stubs(:new).returns key
-      Puppet::SSL::Key.indirection.stubs(:save).with(key)
+      @key = double('key content')
+      key = double('key', :generate => true, :content => @key)
+      allow(Puppet::SSL::Key).to receive(:new).and_return(key)
+      allow(Puppet::SSL::Key.indirection).to receive(:save).with(key)
 
-      @cr = stub('certificate request')
-      Puppet::SSL::CertificateRequest.stubs(:new).returns @cr
-      Puppet::SSL::CertificateRequest.indirection.stubs(:save).with(@cr)
+      @cr = double('certificate request')
+      allow(Puppet::SSL::CertificateRequest).to receive(:new).and_return(@cr)
+      allow(Puppet::SSL::CertificateRequest.indirection).to receive(:save).with(@cr)
     end
 
     describe "explicitly specified" do
@@ -119,13 +118,13 @@ describe Puppet::SSL::Host do
       end
 
       it "should not include subjectAltName if not the local node" do
-        @cr.expects(:generate).with(@key, {})
+        expect(@cr).to receive(:generate).with(@key, {})
 
         Puppet::SSL::Host.new('not-the-' + Puppet[:certname]).generate
       end
 
       it "should include subjectAltName if I am a CA" do
-        @cr.expects(:generate).
+        expect(@cr).to receive(:generate).
           with(@key, { :dns_alt_names => Puppet[:dns_alt_names] })
 
         Puppet::SSL::Host.localhost
@@ -133,45 +132,45 @@ describe Puppet::SSL::Host do
     end
 
     describe "implicitly defaulted" do
-      let(:ca) { stub('ca', :sign => nil) }
+      let(:ca) { double('ca', :sign => nil) }
 
       before :each do
         Puppet[:dns_alt_names] = ''
 
-        Puppet::SSL::CertificateAuthority.stubs(:instance).returns ca
+        allow(Puppet::SSL::CertificateAuthority).to receive(:instance).and_return(ca)
       end
 
       it "should not include defaults if we're not the CA" do
-        Puppet::SSL::CertificateAuthority.stubs(:ca?).returns false
+        allow(Puppet::SSL::CertificateAuthority).to receive(:ca?).and_return(false)
 
-        @cr.expects(:generate).with(@key, {})
+        expect(@cr).to receive(:generate).with(@key, {})
 
         Puppet::SSL::Host.localhost
       end
 
       it "should not include defaults if not the local node" do
-        Puppet::SSL::CertificateAuthority.stubs(:ca?).returns true
+        allow(Puppet::SSL::CertificateAuthority).to receive(:ca?).and_return(true)
 
-        @cr.expects(:generate).with(@key, {})
+        expect(@cr).to receive(:generate).with(@key, {})
 
         Puppet::SSL::Host.new('not-the-' + Puppet[:certname]).generate
       end
 
       it "should not include defaults if we can't resolve our fqdn" do
-        Puppet::SSL::CertificateAuthority.stubs(:ca?).returns true
-        Facter.stubs(:value).with(:fqdn).returns nil
+        allow(Puppet::SSL::CertificateAuthority).to receive(:ca?).and_return(true)
+        allow(Facter).to receive(:value).with(:fqdn).and_return(nil)
 
-        @cr.expects(:generate).with(@key, {})
+        expect(@cr).to receive(:generate).with(@key, {})
 
         Puppet::SSL::Host.localhost
       end
 
       it "should provide defaults if we're bootstrapping the local master" do
-        Puppet::SSL::CertificateAuthority.stubs(:ca?).returns true
-        Facter.stubs(:value).with(:fqdn).returns 'web.foo.com'
-        Facter.stubs(:value).with(:domain).returns 'foo.com'
+        allow(Puppet::SSL::CertificateAuthority).to receive(:ca?).and_return(true)
+        allow(Facter).to receive(:value).with(:fqdn).and_return('web.foo.com')
+        allow(Facter).to receive(:value).with(:domain).and_return('foo.com')
 
-        @cr.expects(:generate).with(@key, {:dns_alt_names => "puppet, web.foo.com, puppet.foo.com"})
+        expect(@cr).to receive(:generate).with(@key, {:dns_alt_names => "puppet, web.foo.com, puppet.foo.com"})
 
         Puppet::SSL::Host.localhost
       end
@@ -179,17 +178,17 @@ describe Puppet::SSL::Host do
   end
 
   it "should always read the key for the localhost instance in from disk" do
-    host = stub 'host', :certificate => "eh"
-    Puppet::SSL::Host.expects(:new).returns host
+    host = double('host', :certificate => "eh")
+    expect(Puppet::SSL::Host).to receive(:new).and_return(host)
 
-    host.expects(:key)
+    expect(host).to receive(:key)
 
     Puppet::SSL::Host.localhost
   end
 
   it "should cache the localhost instance" do
-    host = stub 'host', :certificate => "eh", :key => 'foo'
-    Puppet::SSL::Host.expects(:new).once.returns host
+    host = double('host', :certificate => "eh", :key => 'foo')
+    expect(Puppet::SSL::Host).to receive(:new).once.and_return(host)
     expect(Puppet::SSL::Host.localhost).to eq(Puppet::SSL::Host.localhost)
   end
 
@@ -199,38 +198,38 @@ describe Puppet::SSL::Host do
 
   it "should consider the certificate invalid if it cannot find a key" do
     host = Puppet::SSL::Host.new("foo")
-    certificate = mock('cert', :fingerprint => 'DEADBEEF')
-    host.expects(:certificate).twice.returns certificate
-    host.expects(:key).returns nil
+    certificate = double('cert', :fingerprint => 'DEADBEEF')
+    expect(host).to receive(:certificate).twice.and_return(certificate)
+    expect(host).to receive(:key).and_return(nil)
     expect { host.validate_certificate_with_key }.to raise_error(Puppet::Error, "No private key with which to validate certificate with fingerprint: DEADBEEF")
   end
 
   it "should consider the certificate invalid if it cannot find a certificate" do
     host = Puppet::SSL::Host.new("foo")
-    host.expects(:key).never
-    host.expects(:certificate).returns nil
+    expect(host).not_to receive(:key)
+    expect(host).to receive(:certificate).and_return(nil)
     expect { host.validate_certificate_with_key }.to raise_error(Puppet::Error, "No certificate to validate.")
   end
 
   it "should consider the certificate invalid if the SSL certificate's key verification fails" do
     host = Puppet::SSL::Host.new("foo")
-    key = mock 'key', :content => "private_key"
-    sslcert = mock 'sslcert'
-    certificate = mock 'cert', {:content => sslcert, :fingerprint => 'DEADBEEF'}
-    host.stubs(:key).returns key
-    host.stubs(:certificate).returns certificate
-    sslcert.expects(:check_private_key).with("private_key").returns false
+    key = double('key', :content => "private_key")
+    sslcert = double('sslcert')
+    certificate = double('cert', {:content => sslcert, :fingerprint => 'DEADBEEF'})
+    allow(host).to receive(:key).and_return(key)
+    allow(host).to receive(:certificate).and_return(certificate)
+    expect(sslcert).to receive(:check_private_key).with("private_key").and_return(false)
     expect { host.validate_certificate_with_key }.to raise_error(Puppet::Error, /DEADBEEF/)
   end
 
   it "should consider the certificate valid if the SSL certificate's key verification succeeds" do
     host = Puppet::SSL::Host.new("foo")
-    key = mock 'key', :content => "private_key"
-    sslcert = mock 'sslcert'
-    certificate = mock 'cert', :content => sslcert
-    host.stubs(:key).returns key
-    host.stubs(:certificate).returns certificate
-    sslcert.expects(:check_private_key).with("private_key").returns true
+    key = double('key', :content => "private_key")
+    sslcert = double('sslcert')
+    certificate = double('cert', :content => sslcert)
+    allow(host).to receive(:key).and_return(key)
+    allow(host).to receive(:certificate).and_return(certificate)
+    expect(sslcert).to receive(:check_private_key).with("private_key").and_return(true)
     expect{ host.validate_certificate_with_key }.not_to raise_error
   end
 
@@ -348,21 +347,21 @@ describe Puppet::SSL::Host do
 
   describe "when destroying a host's SSL files" do
     before do
-      Puppet::SSL::Key.indirection.stubs(:destroy).returns false
-      Puppet::SSL::Certificate.indirection.stubs(:destroy).returns false
-      Puppet::SSL::CertificateRequest.indirection.stubs(:destroy).returns false
+      allow(Puppet::SSL::Key.indirection).to receive(:destroy).and_return(false)
+      allow(Puppet::SSL::Certificate.indirection).to receive(:destroy).and_return(false)
+      allow(Puppet::SSL::CertificateRequest.indirection).to receive(:destroy).and_return(false)
     end
 
     it "should destroy its certificate, certificate request, and key" do
-      Puppet::SSL::Key.indirection.expects(:destroy).with("myhost")
-      Puppet::SSL::Certificate.indirection.expects(:destroy).with("myhost")
-      Puppet::SSL::CertificateRequest.indirection.expects(:destroy).with("myhost")
+      expect(Puppet::SSL::Key.indirection).to receive(:destroy).with("myhost")
+      expect(Puppet::SSL::Certificate.indirection).to receive(:destroy).with("myhost")
+      expect(Puppet::SSL::CertificateRequest.indirection).to receive(:destroy).with("myhost")
 
       Puppet::SSL::Host.destroy("myhost")
     end
 
     it "should return true if any of the classes returned true" do
-      Puppet::SSL::Certificate.indirection.expects(:destroy).with("myhost").returns true
+      expect(Puppet::SSL::Certificate.indirection).to receive(:destroy).with("myhost").and_return(true)
 
       expect(Puppet::SSL::Host.destroy("myhost")).to be_truthy
     end
@@ -384,7 +383,7 @@ describe Puppet::SSL::Host do
     end
 
     it "should indicate that it is a CA host if its name matches the ca_name constant" do
-      Puppet::SSL::Host.stubs(:ca_name).returns "myca"
+      allow(Puppet::SSL::Host).to receive(:ca_name).and_return("myca")
       expect(Puppet::SSL::Host.new("myca")).to be_ca
     end
   end
@@ -397,37 +396,37 @@ describe Puppet::SSL::Host do
     end
 
     it "should return nil if the key is not set and cannot be found" do
-      Puppet::SSL::Key.indirection.expects(:find).with("myname").returns(nil)
+      expect(Puppet::SSL::Key.indirection).to receive(:find).with("myname").and_return(nil)
       expect(@host.key).to be_nil
     end
 
     it "should find the key in the Key class and return the Puppet instance" do
-      Puppet::SSL::Key.indirection.expects(:find).with("myname").returns(@key)
+      expect(Puppet::SSL::Key.indirection).to receive(:find).with("myname").and_return(@key)
       expect(@host.key).to equal(@key)
     end
 
     it "should be able to generate and save a new key" do
-      Puppet::SSL::Key.expects(:new).with("myname").returns(@key)
+      expect(Puppet::SSL::Key).to receive(:new).with("myname").and_return(@key)
 
-      @key.expects(:generate)
-      Puppet::SSL::Key.indirection.expects(:save)
+      expect(@key).to receive(:generate)
+      expect(Puppet::SSL::Key.indirection).to receive(:save)
 
       expect(@host.generate_key).to be_truthy
       expect(@host.key).to equal(@key)
     end
 
     it "should not retain keys that could not be saved" do
-      Puppet::SSL::Key.expects(:new).with("myname").returns(@key)
+      expect(Puppet::SSL::Key).to receive(:new).with("myname").and_return(@key)
 
-      @key.stubs(:generate)
-      Puppet::SSL::Key.indirection.expects(:save).raises "eh"
+      expect(@key).to receive(:generate)
+      expect(Puppet::SSL::Key.indirection).to receive(:save).and_raise("eh")
 
       expect { @host.generate_key }.to raise_error(RuntimeError)
       expect(@host.key).to be_nil
     end
 
     it "should return any previously found key without requerying" do
-      Puppet::SSL::Key.indirection.expects(:find).with("myname").returns(@key).once
+      expect(Puppet::SSL::Key.indirection).to receive(:find).with("myname").and_return(@key).once
       expect(@host.key).to equal(@key)
       expect(@host.key).to equal(@key)
     end
@@ -441,60 +440,63 @@ describe Puppet::SSL::Host do
     end
 
     it "should return nil if the key is not set and cannot be found" do
-      Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myname").returns(nil)
+      expect(Puppet::SSL::CertificateRequest.indirection).to receive(:find).with("myname").and_return(nil)
       expect(@host.certificate_request).to be_nil
     end
 
     it "should find the request in the Key class and return it and return the Puppet SSL request" do
-      Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myname").returns @request
+      expect(Puppet::SSL::CertificateRequest.indirection).to receive(:find).with("myname").and_return(@request)
 
       expect(@host.certificate_request).to equal(@request)
     end
 
     it "should generate a new key when generating the cert request if no key exists" do
-      Puppet::SSL::CertificateRequest.expects(:new).with("myname").returns @request
+      expect(Puppet::SSL::CertificateRequest).to receive(:new).with("myname").and_return(@request)
 
-      key = stub 'key', :public_key => mock("public_key"), :content => "mycontent"
+      key = double('key', :public_key => double("public_key"), :content => "mycontent")
 
-      @host.expects(:key).times(2).returns(nil).then.returns(key)
-      @host.expects(:generate_key).returns(key)
+      expect(@host).to receive(:key).twice.and_return(nil, key)
+      expect(@host).to receive(:generate_key).and_return(key)
 
-      @request.stubs(:generate)
-      Puppet::SSL::CertificateRequest.indirection.stubs(:save)
+      allow(@request).to receive(:generate)
+      allow(Puppet::SSL::CertificateRequest.indirection).to receive(:save)
 
       @host.generate_certificate_request
     end
 
     it "should be able to generate and save a new request using the private key" do
-      Puppet::SSL::CertificateRequest.expects(:new).with("myname").returns @request
+      expect(Puppet::SSL::CertificateRequest).to receive(:new).with("myname").and_return(@request)
 
-      key = stub 'key', :public_key => mock("public_key"), :content => "mycontent"
-      @host.stubs(:key).returns(key)
-      @request.expects(:generate).with("mycontent", {})
-      Puppet::SSL::CertificateRequest.indirection.expects(:save).with(@request)
+      key = double('key', :public_key => double("public_key"), :content => "mycontent")
+      allow(@host).to receive(:key).and_return(key)
+      expect(@request).to receive(:generate).with("mycontent", {})
+      expect(Puppet::SSL::CertificateRequest.indirection).to receive(:save).with(@request)
 
       expect(@host.generate_certificate_request).to be_truthy
       expect(@host.certificate_request).to equal(@request)
     end
 
     it "should return any previously found request without requerying" do
-      Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myname").returns(@request).once
+      expect(Puppet::SSL::CertificateRequest.indirection).to receive(:find).with("myname").and_return(@request).once
 
       expect(@host.certificate_request).to equal(@request)
       expect(@host.certificate_request).to equal(@request)
     end
 
     it "should not keep its certificate request in memory if the request cannot be saved" do
-      Puppet::SSL::CertificateRequest.expects(:new).with("myname").returns @request
-
-      key = stub 'key', :public_key => mock("public_key"), :content => "mycontent"
-      @host.stubs(:key).returns(key)
-      @request.stubs(:generate)
-      @request.stubs(:name).returns("myname")
-      terminus = stub 'terminus'
-      terminus.stubs(:validate)
-      Puppet::SSL::CertificateRequest.indirection.expects(:prepare).returns(terminus)
-      terminus.expects(:save).with { |req| req.instance == @request && req.key == "myname" }.raises "eh"
+      expect(Puppet::SSL::CertificateRequest).to receive(:new).with("myname").and_return(@request)
+
+      key = double('key', :public_key => double("public_key"), :content => "mycontent")
+      allow(@host).to receive(:key).and_return(key)
+      allow(@request).to receive(:generate)
+      allow(@request).to receive(:name).and_return("myname")
+      terminus = double('terminus')
+      allow(terminus).to receive(:validate)
+      expect(Puppet::SSL::CertificateRequest.indirection).to receive(:prepare).and_return(terminus)
+      expect(terminus).to receive(:save) do |req|
+        expect(req.instance).to eq(@request)
+        expect(req.key).to eq("myname")
+      end.and_raise("eh")
 
       expect { @host.generate_certificate_request }.to raise_error(RuntimeError)
 
@@ -504,55 +506,55 @@ describe Puppet::SSL::Host do
 
   describe "when managing its certificate" do
     before do
-      @realcert = mock 'certificate'
-      @cert = stub 'cert', :content => @realcert
-      @host.stubs(:key).returns mock("key")
-      @host.stubs(:validate_certificate_with_key)
+      @realcert = double('certificate')
+      @cert = double('cert', :content => @realcert)
+      allow(@host).to receive(:key).and_return(double("key"))
+      allow(@host).to receive(:validate_certificate_with_key)
     end
 
     it "should find the CA certificate if it does not have a certificate" do
-      Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME, :fail_on_404 => true).returns mock("cacert")
-      Puppet::SSL::Certificate.indirection.stubs(:find).with("myname").returns @cert
+      expect(Puppet::SSL::Certificate.indirection).to receive(:find).with(Puppet::SSL::CA_NAME, :fail_on_404 => true).and_return(double("cacert"))
+      allow(Puppet::SSL::Certificate.indirection).to receive(:find).with("myname").and_return(@cert)
       @host.certificate
     end
 
     it "should not find the CA certificate if it is the CA host" do
-      @host.expects(:ca?).returns true
-      Puppet::SSL::Certificate.indirection.stubs(:find)
-      Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME, :fail_on_404 => true).never
+      expect(@host).to receive(:ca?).and_return(true)
+      allow(Puppet::SSL::Certificate.indirection).to receive(:find)
+      expect(Puppet::SSL::Certificate.indirection).not_to receive(:find).with(Puppet::SSL::CA_NAME, :fail_on_404 => true)
 
       @host.certificate
     end
 
     it "should return nil if it cannot find a CA certificate" do
-      Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME, :fail_on_404 => true).returns nil
-      Puppet::SSL::Certificate.indirection.expects(:find).with("myname").never
+      expect(Puppet::SSL::Certificate.indirection).to receive(:find).with(Puppet::SSL::CA_NAME, :fail_on_404 => true).and_return(nil)
+      expect(Puppet::SSL::Certificate.indirection).not_to receive(:find).with("myname")
 
       expect(@host.certificate).to be_nil
     end
 
     it "should find the key if it does not have one" do
-      Puppet::SSL::Certificate.indirection.stubs(:find)
-      @host.expects(:key).returns mock("key")
+      allow(Puppet::SSL::Certificate.indirection).to receive(:find)
+      expect(@host).to receive(:key).and_return(double("key"))
       @host.certificate
     end
 
     it "should generate the key if one cannot be found" do
-      Puppet::SSL::Certificate.indirection.stubs(:find)
-      @host.expects(:key).returns nil
-      @host.expects(:generate_key)
+      allow(Puppet::SSL::Certificate.indirection).to receive(:find)
+      expect(@host).to receive(:key).and_return(nil)
+      expect(@host).to receive(:generate_key)
       @host.certificate
     end
 
     it "should find the certificate in the Certificate class and return the Puppet certificate instance" do
-      Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME, :fail_on_404 => true).returns mock("cacert")
-      Puppet::SSL::Certificate.indirection.expects(:find).with("myname").returns @cert
+      expect(Puppet::SSL::Certificate.indirection).to receive(:find).with(Puppet::SSL::CA_NAME, :fail_on_404 => true).and_return(double("cacert"))
+      expect(Puppet::SSL::Certificate.indirection).to receive(:find).with("myname").and_return(@cert)
       expect(@host.certificate).to equal(@cert)
     end
 
     it "should return any previously found certificate" do
-      Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME, :fail_on_404 => true).returns mock("cacert")
-      Puppet::SSL::Certificate.indirection.expects(:find).with("myname").returns(@cert).once
+      expect(Puppet::SSL::Certificate.indirection).to receive(:find).with(Puppet::SSL::CA_NAME, :fail_on_404 => true).and_return(double("cacert"))
+      expect(Puppet::SSL::Certificate.indirection).to receive(:find).with("myname").and_return(@cert).once
 
       expect(@host.certificate).to equal(@cert)
       expect(@host.certificate).to equal(@cert)
@@ -565,47 +567,47 @@ describe Puppet::SSL::Host do
 
   describe "when listing certificate hosts" do
     it "should default to listing all clients with any file types" do
-      Puppet::SSL::Key.indirection.expects(:search).returns []
-      Puppet::SSL::Certificate.indirection.expects(:search).returns []
-      Puppet::SSL::CertificateRequest.indirection.expects(:search).returns []
+      expect(Puppet::SSL::Key.indirection).to receive(:search).and_return([])
+      expect(Puppet::SSL::Certificate.indirection).to receive(:search).and_return([])
+      expect(Puppet::SSL::CertificateRequest.indirection).to receive(:search).and_return([])
       Puppet::SSL::Host.search
     end
 
     it "should be able to list only clients with a key" do
-      Puppet::SSL::Key.indirection.expects(:search).returns []
-      Puppet::SSL::Certificate.indirection.expects(:search).never
-      Puppet::SSL::CertificateRequest.indirection.expects(:search).never
+      expect(Puppet::SSL::Key.indirection).to receive(:search).and_return([])
+      expect(Puppet::SSL::Certificate.indirection).not_to receive(:search)
+      expect(Puppet::SSL::CertificateRequest.indirection).not_to receive(:search)
       Puppet::SSL::Host.search :for => Puppet::SSL::Key
     end
 
     it "should be able to list only clients with a certificate" do
-      Puppet::SSL::Key.indirection.expects(:search).never
-      Puppet::SSL::Certificate.indirection.expects(:search).returns []
-      Puppet::SSL::CertificateRequest.indirection.expects(:search).never
+      expect(Puppet::SSL::Key.indirection).not_to receive(:search)
+      expect(Puppet::SSL::Certificate.indirection).to receive(:search).and_return([])
+      expect(Puppet::SSL::CertificateRequest.indirection).not_to receive(:search)
       Puppet::SSL::Host.search :for => Puppet::SSL::Certificate
     end
 
     it "should be able to list only clients with a certificate request" do
-      Puppet::SSL::Key.indirection.expects(:search).never
-      Puppet::SSL::Certificate.indirection.expects(:search).never
-      Puppet::SSL::CertificateRequest.indirection.expects(:search).returns []
+      expect(Puppet::SSL::Key.indirection).not_to receive(:search)
+      expect(Puppet::SSL::Certificate.indirection).not_to receive(:search)
+      expect(Puppet::SSL::CertificateRequest.indirection).to receive(:search).and_return([])
       Puppet::SSL::Host.search :for => Puppet::SSL::CertificateRequest
     end
 
     it "should return a Host instance created with the name of each found instance" do
-      key  = stub 'key',  :name => "key",  :to_ary => nil
-      cert = stub 'cert', :name => "cert", :to_ary => nil
-      csr  = stub 'csr',  :name => "csr",  :to_ary => nil
+      key  = double('key',  :name => "key",  :to_ary => nil)
+      cert = double('cert', :name => "cert", :to_ary => nil)
+      csr  = double('csr',  :name => "csr",  :to_ary => nil)
 
-      Puppet::SSL::Key.indirection.expects(:search).returns [key]
-      Puppet::SSL::Certificate.indirection.expects(:search).returns [cert]
-      Puppet::SSL::CertificateRequest.indirection.expects(:search).returns [csr]
+      expect(Puppet::SSL::Key.indirection).to receive(:search).and_return([key])
+      expect(Puppet::SSL::Certificate.indirection).to receive(:search).and_return([cert])
+      expect(Puppet::SSL::CertificateRequest.indirection).to receive(:search).and_return([csr])
 
       returned = []
       %w{key cert csr}.each do |name|
-        result = mock(name)
+        result = double(name)
         returned << result
-        Puppet::SSL::Host.expects(:new).with(name).returns result
+        expect(Puppet::SSL::Host).to receive(:new).with(name).and_return(result)
       end
 
       result = Puppet::SSL::Host.search
@@ -622,34 +624,34 @@ describe Puppet::SSL::Host do
   describe "when generating files" do
     before do
       @host = Puppet::SSL::Host.new("me")
-      @host.stubs(:generate_key)
-      @host.stubs(:generate_certificate_request)
+      allow(@host).to receive(:generate_key)
+      allow(@host).to receive(:generate_certificate_request)
     end
 
     it "should generate a key if one is not present" do
-      @host.stubs(:key).returns nil
-      @host.expects(:generate_key)
+      allow(@host).to receive(:key).and_return nil
+      expect(@host).to receive(:generate_key)
 
       @host.generate
     end
 
     it "should generate a certificate request if one is not present" do
-      @host.expects(:certificate_request).returns nil
-      @host.expects(:generate_certificate_request)
+      expect(@host).to receive(:certificate_request).and_return nil
+      expect(@host).to receive(:generate_certificate_request)
 
       @host.generate
     end
 
     describe "and it can create a certificate authority" do
       before do
-        @ca = mock 'ca'
-        Puppet::SSL::CertificateAuthority.stubs(:instance).returns @ca
+        @ca = double('ca')
+        allow(Puppet::SSL::CertificateAuthority).to receive(:instance).and_return(@ca)
       end
 
       it "should use the CA to sign its certificate request if it does not have a certificate" do
-        @host.expects(:certificate).returns nil
+        expect(@host).to receive(:certificate).and_return(nil)
 
-        @ca.expects(:sign).with(@host.name, {allow_dns_alt_names: true})
+        expect(@ca).to receive(:sign).with(@host.name, {allow_dns_alt_names: true})
 
         @host.generate
       end
@@ -657,11 +659,11 @@ describe Puppet::SSL::Host do
 
     describe "and it cannot create a certificate authority" do
       before do
-        Puppet::SSL::CertificateAuthority.stubs(:instance).returns nil
+        allow(Puppet::SSL::CertificateAuthority).to receive(:instance).and_return(nil)
       end
 
       it "should seek its certificate" do
-        @host.expects(:certificate)
+        expect(@host).to receive(:certificate)
 
         @host.generate
       end
@@ -674,44 +676,52 @@ describe Puppet::SSL::Host do
 
   it "should always return the same store" do
     host = Puppet::SSL::Host.new("foo")
-    store = mock 'store'
-    store.stub_everything
-    OpenSSL::X509::Store.expects(:new).returns store
+    store = double(
+      'store',
+      :purpose= => nil,
+      :add_file => nil,
+    )
+    expect(OpenSSL::X509::Store).to receive(:new).and_return(store)
     expect(host.ssl_store).to equal(host.ssl_store)
   end
 
   describe "when creating an SSL store" do
     before do
       @host = Puppet::SSL::Host.new("me")
-      @store = mock 'store'
-      @store.stub_everything
-      OpenSSL::X509::Store.stubs(:new).returns @store
+      @store = double(
+        'store',
+        :purpose= => nil,
+        :add_file => nil,
+        :add_crl  => nil,
+        :flags=   => nil,
+      )
+      allow(OpenSSL::X509::Store).to receive(:new).and_return(@store)
 
       Puppet[:localcacert] = "ssl_host_testing"
 
-      Puppet::SSL::CertificateRevocationList.indirection.stubs(:find).returns(nil)
+      allow(Puppet::SSL::CertificateRevocationList.indirection).to receive(:find).and_return(nil)
     end
 
     it "should accept a purpose" do
-      @store.expects(:purpose=).with "my special purpose"
+      expect(@store).to receive(:purpose=).with("my special purpose")
       @host.ssl_store("my special purpose")
     end
 
     it "should default to OpenSSL::X509::PURPOSE_ANY as the purpose" do
-      @store.expects(:purpose=).with OpenSSL::X509::PURPOSE_ANY
+      expect(@store).to receive(:purpose=).with(OpenSSL::X509::PURPOSE_ANY)
       @host.ssl_store
     end
 
     it "should add the local CA cert file" do
       Puppet[:localcacert] = "/ca/cert/file"
-      @store.expects(:add_file).with Puppet[:localcacert]
+      expect(@store).to receive(:add_file).with(Puppet[:localcacert])
       @host.ssl_store
     end
 
     describe "and a CRL is available" do
       before do
-        @crl = stub 'crl', :content => "real_crl"
-        Puppet::SSL::CertificateRevocationList.indirection.stubs(:find).returns @crl
+        @crl = double('crl', :content => "real_crl")
+        allow(Puppet::SSL::CertificateRevocationList.indirection).to receive(:find).and_return(@crl)
       end
 
       [true, 'chain'].each do |crl_setting|
@@ -721,12 +731,12 @@ describe Puppet::SSL::Host do
           end
 
           it "should add the CRL" do
-            @store.expects(:add_crl).with "real_crl"
+            expect(@store).to receive(:add_crl).with("real_crl")
             @host.ssl_store
           end
 
           it "should set the flags to OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK" do
-            @store.expects(:flags=).with(OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK)
+            expect(@store).to receive(:flags=).with(OpenSSL::X509::V_FLAG_CRL_CHECK_ALL | OpenSSL::X509::V_FLAG_CRL_CHECK)
             @host.ssl_store
           end
         end
@@ -738,12 +748,12 @@ describe Puppet::SSL::Host do
         end
 
         it "should add the CRL" do
-          @store.expects(:add_crl).with "real_crl"
+          expect(@store).to receive(:add_crl).with("real_crl")
           @host.ssl_store
         end
 
         it "should set the flags to OpenSSL::X509::V_FLAG_CRL_CHECK" do
-          @store.expects(:flags=).with(OpenSSL::X509::V_FLAG_CRL_CHECK)
+          expect(@store).to receive(:flags=).with(OpenSSL::X509::V_FLAG_CRL_CHECK)
           @host.ssl_store
         end
       end
@@ -754,12 +764,12 @@ describe Puppet::SSL::Host do
         end
 
         it "should not add the CRL" do
-          @store.expects(:add_crl).never
+          expect(@store).not_to receive(:add_crl)
           @host.ssl_store
         end
 
         it "should not set the flags" do
-          @store.expects(:flags=).never
+          expect(@store).not_to receive(:flags=)
           @host.ssl_store
         end
       end
@@ -772,54 +782,73 @@ describe Puppet::SSL::Host do
     end
 
     it "should generate its certificate request and attempt to read the certificate again if no certificate is found" do
-      @host.expects(:certificate).times(2).returns(nil).then.returns "foo"
-      @host.expects(:generate)
+      expect(@host).to receive(:certificate).twice.and_return(nil, "foo")
+      expect(@host).to receive(:generate)
       @host.wait_for_cert(1)
     end
 
     it "should catch and log errors during CSR saving" do
-      @host.expects(:certificate).times(2).returns(nil).then.returns "foo"
-      @host.expects(:generate).raises(RuntimeError).then.returns nil
-      @host.stubs(:sleep)
+      expect(@host).to receive(:certificate).twice.and_return(nil, "foo")
+      times_generate_called = 0
+      expect(@host).to receive(:generate) do
+        times_generate_called += 1
+        raise RuntimeError if times_generate_called == 1
+        nil
+      end
+      allow(@host).to receive(:sleep)
       @host.wait_for_cert(1)
     end
 
     it "should sleep and retry after failures saving the CSR if waitforcert is enabled" do
-      @host.expects(:certificate).times(2).returns(nil).then.returns "foo"
-      @host.expects(:generate).raises(RuntimeError).then.returns nil
-      @host.expects(:sleep).with(1)
+      expect(@host).to receive(:certificate).twice.and_return(nil, "foo")
+      times_generate_called = 0
+      expect(@host).to receive(:generate) do
+        times_generate_called += 1
+        raise RuntimeError if times_generate_called == 1
+        nil
+      end
+      expect(@host).to receive(:sleep).with(1)
       @host.wait_for_cert(1)
     end
 
     it "should exit after failures saving the CSR of waitforcert is disabled" do
-      @host.expects(:certificate).returns(nil)
-      @host.expects(:generate).raises(RuntimeError)
-      @host.expects(:puts)
+      expect(@host).to receive(:certificate).and_return(nil)
+      expect(@host).to receive(:generate).and_raise(RuntimeError)
+      expect(@host).to receive(:puts)
       expect { @host.wait_for_cert(0) }.to exit_with 1
     end
 
     it "should exit if the wait time is 0 and it can neither find nor retrieve a certificate" do
-      @host.stubs(:certificate).returns nil
-      @host.expects(:generate)
-      @host.expects(:puts)
+      allow(@host).to receive(:certificate).and_return(nil)
+      expect(@host).to receive(:generate)
+      expect(@host).to receive(:puts)
       expect { @host.wait_for_cert(0) }.to exit_with 1
     end
 
     it "should sleep for the specified amount of time if no certificate is found after generating its certificate request" do
-      @host.expects(:certificate).times(3).returns(nil).then.returns(nil).then.returns "foo"
-      @host.expects(:generate)
+      expect(@host).to receive(:certificate).exactly(3).times().and_return(nil, nil, "foo")
+      expect(@host).to receive(:generate)
 
-      @host.expects(:sleep).with(1)
+      expect(@host).to receive(:sleep).with(1)
 
       @host.wait_for_cert(1)
     end
 
     it "should catch and log exceptions during certificate retrieval" do
-      @host.expects(:certificate).times(3).returns(nil).then.raises(RuntimeError).then.returns("foo")
-      @host.stubs(:generate)
-      @host.stubs(:sleep)
+      times_certificate_called = 0
+      expect(@host).to receive(:certificate) do
+        times_certificate_called += 1
+        if times_certificate_called == 1
+          return nil
+        elsif times_certificate_called == 2
+          raise RuntimeError
+        end
+        "foo"
+      end.exactly(3).times()
+      allow(@host).to receive(:generate)
+      allow(@host).to receive(:sleep)
 
-      Puppet.expects(:err)
+      expect(Puppet).to receive(:err).twice
 
       @host.wait_for_cert(1)
     end