puppet 5.5.22-universal-darwin → 6.0.0-universal-darwin

data/spec/unit/ssl/key_spec.rb

@@ -1,3 +1,4 @@
+#! /usr/bin/env ruby
 require 'spec_helper'
 
 require 'puppet/ssl/key'
@@ -19,22 +20,7 @@ describe Puppet::SSL::Key do
     expect(@class.supported_formats).to eq([:s])
   end
 
-  it "should have a method for determining whether it's a CA key" do
-    expect(@class.new("test")).to respond_to(:ca?)
-  end
-
-  it "should consider itself a ca key if its name matches the CA_NAME" do
-    expect(@class.new(Puppet::SSL::Host.ca_name)).to be_ca
-  end
-
   describe "when initializing" do
-    it "should set its password file to the :capass if it's a CA key" do
-      Puppet[:capass] = File.expand_path("/ca/pass")
-
-      key = Puppet::SSL::Key.new(Puppet::SSL::Host.ca_name)
-      expect(key.password_file).to eq(Puppet[:capass])
-    end
-
     it "should downcase its name" do
       expect(@class.new("MyName").name).to eq("myname")
     end
@@ -62,36 +48,36 @@ describe Puppet::SSL::Key do
 
     it "should be able to read keys from disk" do
       path = "/my/path"
-      expect(Puppet::FileSystem).to receive(:read).with(path, :encoding => Encoding::ASCII).and_return("my key")
-      key = double('key')
-      expect(OpenSSL::PKey::RSA).to receive(:new).and_return(key)
+      Puppet::FileSystem.expects(:read).with(path, :encoding => Encoding::ASCII).returns("my key")
+      key = mock 'key'
+      OpenSSL::PKey::RSA.expects(:new).returns(key)
       expect(@key.read(path)).to equal(key)
       expect(@key.content).to equal(key)
     end
 
     it "should not try to use the provided password file if the file does not exist" do
-      allow(Puppet::FileSystem).to receive(:exist?).and_return(false)
+      Puppet::FileSystem.stubs(:exist?).returns false
       @key.password_file = "/path/to/password"
 
       path = "/my/path"
 
-      allow(Puppet::FileSystem).to receive(:read).with(path, :encoding => Encoding::ASCII).and_return("my key")
-      expect(OpenSSL::PKey::RSA).to receive(:new).with("my key", nil).and_return(double('key'))
-      expect(Puppet::FileSystem).not_to receive(:read).with("/path/to/password", :encoding => Encoding::BINARY)
+      Puppet::FileSystem.stubs(:read).with(path, :encoding => Encoding::ASCII).returns("my key")
+      OpenSSL::PKey::RSA.expects(:new).with("my key", nil).returns(mock('key'))
+      Puppet::FileSystem.expects(:read).with("/path/to/password", :encoding => Encoding::BINARY).never
 
       @key.read(path)
     end
 
     it "should read the key with the password retrieved from the password file if one is provided" do
-      allow(Puppet::FileSystem).to receive(:exist?).and_return(true)
+      Puppet::FileSystem.stubs(:exist?).returns true
       @key.password_file = "/path/to/password"
 
       path = "/my/path"
-      expect(Puppet::FileSystem).to receive(:read).with(path, :encoding => Encoding::ASCII).and_return("my key")
-      expect(Puppet::FileSystem).to receive(:read).with("/path/to/password", :encoding => Encoding::BINARY).and_return("my password")
+      Puppet::FileSystem.expects(:read).with(path, :encoding => Encoding::ASCII).returns("my key")
+      Puppet::FileSystem.expects(:read).with("/path/to/password", :encoding => Encoding::BINARY).returns("my password")
 
-      key = double('key')
-      expect(OpenSSL::PKey::RSA).to receive(:new).with("my key", "my password").and_return(key)
+      key = mock 'key'
+      OpenSSL::PKey::RSA.expects(:new).with("my key", "my password").returns(key)
       expect(@key.read(path)).to equal(key)
       expect(@key.content).to equal(key)
     end
@@ -101,14 +87,14 @@ describe Puppet::SSL::Key do
     end
 
     it "should convert the key to pem format when converted to a string" do
-      key = double('key', :to_pem => "pem")
+      key = mock 'key', :to_pem => "pem"
       @key.content = key
       expect(@key.to_s).to eq("pem")
     end
 
     it "should have a :to_text method that it delegates to the actual key" do
-      real_key = double('key')
-      expect(real_key).to receive(:to_text).and_return("keytext")
+      real_key = mock 'key'
+      real_key.expects(:to_text).returns "keytext"
       @key.content = real_key
       expect(@key.to_text).to eq("keytext")
     end
@@ -118,43 +104,43 @@ describe Puppet::SSL::Key do
     before do
       @instance = @class.new("test")
 
-      @key = double('key')
+      @key = mock 'key'
     end
 
     it "should create an instance of OpenSSL::PKey::RSA" do
-      expect(OpenSSL::PKey::RSA).to receive(:new).and_return(@key)
+      OpenSSL::PKey::RSA.expects(:new).returns(@key)
 
       @instance.generate
     end
 
     it "should create the private key with the keylength specified in the settings" do
-      Puppet[:keylength] = 513
-      expect(OpenSSL::PKey::RSA).to receive(:new).with(513).and_return(@key)
+      Puppet[:keylength] = "50"
+      OpenSSL::PKey::RSA.expects(:new).with(50).returns(@key)
 
       @instance.generate
     end
 
     it "should set the content to the generated key" do
-      allow(OpenSSL::PKey::RSA).to receive(:new).and_return(@key)
+      OpenSSL::PKey::RSA.stubs(:new).returns(@key)
       @instance.generate
       expect(@instance.content).to equal(@key)
     end
 
     it "should return the generated key" do
-      allow(OpenSSL::PKey::RSA).to receive(:new).and_return(@key)
+      OpenSSL::PKey::RSA.stubs(:new).returns(@key)
       expect(@instance.generate).to equal(@key)
     end
 
     it "should return the key in pem format" do
       @instance.generate
-      expect(@instance.content).to receive(:to_pem).and_return("my normal key")
+      @instance.content.expects(:to_pem).returns "my normal key"
       expect(@instance.to_s).to eq("my normal key")
     end
 
     describe "with a password file set" do
       it "should return a nil password if the password file does not exist" do
-        expect(Puppet::FileSystem).to receive(:exist?).with("/path/to/pass").and_return(false)
-        expect(Puppet::FileSystem).not_to receive(:read).with("/path/to/pass", :encoding => Encoding::BINARY)
+        Puppet::FileSystem.expects(:exist?).with("/path/to/pass").returns false
+        Puppet::FileSystem.expects(:read).with("/path/to/pass", :encoding => Encoding::BINARY).never
 
         @instance.password_file = "/path/to/pass"
 
@@ -162,8 +148,8 @@ describe Puppet::SSL::Key do
       end
 
       it "should return the contents of the password file as its password" do
-        expect(Puppet::FileSystem).to receive(:exist?).with("/path/to/pass").and_return(true)
-        expect(Puppet::FileSystem).to receive(:read).with("/path/to/pass", :encoding => Encoding::BINARY).and_return("my password")
+        Puppet::FileSystem.expects(:exist?).with("/path/to/pass").returns true
+        Puppet::FileSystem.expects(:read).with("/path/to/pass", :encoding => Encoding::BINARY).returns "my password"
 
         @instance.password_file = "/path/to/pass"
 
@@ -171,15 +157,17 @@ describe Puppet::SSL::Key do
       end
 
       it "should export the private key to text using the password" do
+        Puppet[:keylength] = "50"
+
         @instance.password_file = "/path/to/pass"
-        allow(@instance).to receive(:password).and_return("my password")
+        @instance.stubs(:password).returns "my password"
 
-        expect(OpenSSL::PKey::RSA).to receive(:new).and_return(@key)
+        OpenSSL::PKey::RSA.expects(:new).returns(@key)
         @instance.generate
 
-        cipher = double('cipher')
-        expect(OpenSSL::Cipher::DES).to receive(:new).with(:EDE3, :CBC).and_return(cipher)
-        expect(@key).to receive(:export).with(cipher, "my password").and_return("my encrypted key")
+        cipher = mock 'cipher'
+        OpenSSL::Cipher::DES.expects(:new).with(:EDE3, :CBC).returns cipher
+        @key.expects(:export).with(cipher, "my password").returns "my encrypted key"
 
         expect(@instance.to_s).to eq("my encrypted key")
       end

data/spec/unit/ssl/validator_spec.rb

@@ -1,72 +1,73 @@
 require 'spec_helper'
 require 'puppet/ssl'
+require 'puppet_spec/ssl'
 
-describe Puppet::SSL::Validator::DefaultValidator do
+describe Puppet::SSL::Validator::DefaultValidator, unless: Puppet::Util::Platform.jruby? do
+  include PuppetSpec::Files
   let(:ssl_context) do
-    double('OpenSSL::X509::StoreContext')
+    mock('OpenSSL::X509::StoreContext')
   end
 
-  let(:ssl_configuration) do
-    Puppet::SSL::Configuration.new(
-      Puppet[:localcacert],
-      :ca_auth_file  => Puppet[:ssl_client_ca_auth])
+  before(:all) do
+    @pki = PuppetSpec::SSL.create_chained_pki
+  end
+
+  let(:ca_path) do
+    Puppet[:ssl_client_ca_auth] || Puppet[:localcacert]
   end
 
   let(:ssl_host) do
-    double('ssl_host',
-           :ssl_store => nil,
-           :certificate => double('cert', :content => nil),
-           :key => double('key', :content => nil))
+    stub('ssl_host',
+         :ssl_store => nil,
+         :certificate => stub('cert', :content => nil),
+         :key => stub('key', :content => nil))
   end
 
   subject do
-    described_class.new(ssl_configuration,
-                        ssl_host)
+    described_class.new(ca_path)
   end
 
   before :each do
-    allow(ssl_configuration).to receive(:read_file).
-      with(Puppet[:localcacert]).
-      and_return(root_ca)
+    subject.stubs(:read_file).returns(@pki[:root_cert].to_s)
   end
 
   describe '#call' do
     before :each do
-      allow(ssl_context).to receive(:current_cert).and_return(*cert_chain_in_callback_order)
-      allow(ssl_context).to receive(:chain).and_return(cert_chain)
+      ssl_context.stubs(:current_cert).returns(*cert_chain_in_callback_order)
+      ssl_context.stubs(:chain).returns(cert_chain)
     end
 
     context 'When pre-verification is not OK' do
       context 'and the ssl_context is in an error state' do
-        let(:root_subject) { OpenSSL::X509::Certificate.new(root_ca).subject.to_s }
+        let(:root_subject) { @pki[:root_cert].subject.to_s }
         let(:code) { OpenSSL::X509::V_ERR_INVALID_CA }
 
         it 'rejects the connection' do
-          allow(ssl_context).to receive(:error_string).and_return("Something went wrong")
-          allow(ssl_context).to receive(:error).and_return(code)
+          ssl_context.stubs(:error_string).returns("Something went wrong")
+          ssl_context.stubs(:error).returns(code)
 
           expect(subject.call(false, ssl_context)).to eq(false)
         end
 
         it 'makes the error available via #verify_errors' do
-          allow(ssl_context).to receive(:error_string).and_return("Something went wrong")
-          allow(ssl_context).to receive(:error).and_return(code)
+          ssl_context.stubs(:error_string).returns("Something went wrong")
+          ssl_context.stubs(:error).returns(code)
 
           subject.call(false, ssl_context)
           expect(subject.verify_errors).to eq(["Something went wrong for #{root_subject}"])
         end
 
         it 'uses a generic message if error_string is nil' do
-          allow(ssl_context).to receive(:error_string).and_return(nil)
-          allow(ssl_context).to receive(:error).and_return(code)
+          ssl_context.stubs(:error_string).returns(nil)
+          ssl_context.stubs(:error).returns(code)
 
           subject.call(false, ssl_context)
           expect(subject.verify_errors).to eq(["OpenSSL error #{code} for #{root_subject}"])
         end
 
         it 'uses 0 for nil error codes' do
-          allow(ssl_context).to receive(:error_string).and_return("Something went wrong")
-          allow(ssl_context).to receive(:error).and_return(nil)
+          ssl_context.stubs(:error_string).returns("Something went wrong")
+          ssl_context.stubs(:error).returns(nil)
 
           subject.call(false, ssl_context)
           expect(subject.verify_errors).to eq(["Something went wrong for #{root_subject}"])
@@ -74,12 +75,12 @@ describe Puppet::SSL::Validator::DefaultValidator do
 
         context "when CRL is not yet valid" do
           before :each do
-            allow(ssl_context).to receive(:error_string).and_return("CRL is not yet valid")
-            allow(ssl_context).to receive(:error).and_return(OpenSSL::X509::V_ERR_CRL_NOT_YET_VALID)
+            ssl_context.stubs(:error_string).returns("CRL is not yet valid")
+            ssl_context.stubs(:error).returns(OpenSSL::X509::V_ERR_CRL_NOT_YET_VALID)
           end
 
           it 'rejects nil CRL' do
-            allow(ssl_context).to receive(:current_crl).and_return(nil)
+            ssl_context.stubs(:current_crl).returns(nil)
 
             expect(subject.call(false, ssl_context)).to eq(false)
             expect(subject.verify_errors).to eq(["CRL is not yet valid"])
@@ -89,7 +90,7 @@ describe Puppet::SSL::Validator::DefaultValidator do
             crl = OpenSSL::X509::CRL.new
             crl.issuer = OpenSSL::X509::Name.new([['CN','Puppet CA: puppetmaster.example.com']])
             crl.last_update = Time.now + 24 * 60 * 60
-            allow(ssl_context).to receive(:current_crl).and_return(crl)
+            ssl_context.stubs(:current_crl).returns(crl)
 
             subject.call(false, ssl_context)
             expect(subject.verify_errors).to eq(["CRL is not yet valid for /CN=Puppet CA: puppetmaster.example.com"])
@@ -99,7 +100,7 @@ describe Puppet::SSL::Validator::DefaultValidator do
             crl = OpenSSL::X509::CRL.new
             crl.issuer = OpenSSL::X509::Name.new([['CN','Puppet CA: puppetmaster.example.com']])
             crl.last_update = Time.now + 24 * 60 * 60
-            allow(ssl_context).to receive(:current_crl).and_return(crl)
+            ssl_context.stubs(:current_crl).returns(crl)
 
             expect(subject.call(false, ssl_context)).to eq(false)
           end
@@ -108,7 +109,7 @@ describe Puppet::SSL::Validator::DefaultValidator do
             crl = OpenSSL::X509::CRL.new
             crl.issuer = OpenSSL::X509::Name.new([['CN','Puppet CA: puppetmaster.example.com']])
             crl.last_update = Time.now + 10
-            allow(ssl_context).to receive(:current_crl).and_return(crl)
+            ssl_context.stubs(:current_crl).returns(crl)
 
             expect(subject.call(false, ssl_context)).to eq(true)
           end
@@ -119,7 +120,7 @@ describe Puppet::SSL::Validator::DefaultValidator do
     context 'When pre-verification is OK' do
       context 'and the ssl_context is in an error state' do
         before :each do
-          allow(ssl_context).to receive(:error_string).and_return("Something went wrong")
+          ssl_context.stubs(:error_string).returns("Something went wrong")
         end
 
         it 'does not make the error available via #verify_errors' do
@@ -145,9 +146,7 @@ describe Puppet::SSL::Validator::DefaultValidator do
 
       context 'and the chain is invalid' do
         before :each do
-          allow(ssl_configuration).to receive(:read_file).
-            with(Puppet[:localcacert]).
-            and_return(agent_ca)
+          subject.stubs(:read_file).returns(@pki[:unrevoked_leaf_node_cert])
         end
 
         it 'is true for each CA certificate in the chain' do
@@ -166,7 +165,7 @@ describe Puppet::SSL::Validator::DefaultValidator do
 
       context 'an error is raised inside of #call' do
         before :each do
-          expect(ssl_context).to receive(:current_cert).and_raise(StandardError, "BOOM!")
+          ssl_context.expects(:current_cert).raises(StandardError, "BOOM!")
         end
 
         it 'is false' do
@@ -183,42 +182,40 @@ describe Puppet::SSL::Validator::DefaultValidator do
 
   describe '#setup_connection' do
     it 'updates the connection for verification' do
-      allow(subject).to receive(:ssl_certificates_are_present?).and_return(true)
-      connection = double('Net::HTTP')
-
-      allow(connection).to receive(:address).and_return('puppet.com')
-      expect(connection).to receive(:cert_store=).with(ssl_host.ssl_store)
-      expect(connection).to receive(:ca_file=).with(ssl_configuration.ca_auth_file)
-      expect(connection).to receive(:cert=).with(ssl_host.certificate.content)
-      expect(connection).to receive(:key=).with(ssl_host.key.content)
-      expect(connection).to receive(:verify_callback=).with(subject)
-      expect(connection).to receive(:verify_mode=).with(OpenSSL::SSL::VERIFY_PEER)
-
-      subject.setup_connection(connection)
+      subject.stubs(:ssl_certificates_are_present?).returns(true)
+      connection = mock('Net::HTTP')
+
+      connection.expects(:cert_store=).with(ssl_host.ssl_store)
+      connection.expects(:ca_file=).with(ca_path)
+      connection.expects(:cert=).with(ssl_host.certificate.content)
+      connection.expects(:key=).with(ssl_host.key.content)
+      connection.expects(:verify_callback=).with(subject)
+      connection.expects(:verify_mode=).with(OpenSSL::SSL::VERIFY_PEER)
+
+      subject.setup_connection(connection, ssl_host)
     end
 
-    it 'does not perform verification if certificate files are missing' do
-      allow(subject).to receive(:ssl_certificates_are_present?).and_return(false)
-      connection = double('Net::HTTP')
+    context 'when no file path is found' do
 
-      allow(connection).to receive(:address).and_return('puppet.com')
-      expect(connection).to receive(:verify_mode=).with(OpenSSL::SSL::VERIFY_NONE)
+      it 'does not perform verification if certificate files are missing' do
+        subject.stubs(:ssl_certificates_are_present?).returns(false)
+        connection = mock('Net::HTTP')
 
-      subject.setup_connection(connection)
+        connection.expects(:verify_mode=).with(OpenSSL::SSL::VERIFY_NONE)
+
+        subject.setup_connection(connection, ssl_host)
+      end
     end
   end
 
   describe '#valid_peer?' do
     before :each do
-      peer_certs = cert_chain_in_callback_order.map do |c|
-        Puppet::SSL::Certificate.from_instance(c)
-      end
-      subject.instance_variable_set(:@peer_certs, peer_certs)
+      subject.instance_variable_set(:@peer_certs, cert_chain_in_callback_order)
     end
 
     context 'when the peer presents a valid chain' do
       before :each do
-        allow(subject).to receive(:has_authz_peer_cert).and_return(true)
+        subject.stubs(:has_authz_peer_cert).returns(true)
       end
 
       it 'is true' do
@@ -228,7 +225,7 @@ describe Puppet::SSL::Validator::DefaultValidator do
 
     context 'when the peer presents an invalid chain' do
       before :each do
-        allow(subject).to receive(:has_authz_peer_cert).and_return(false)
+        subject.stubs(:has_authz_peer_cert).returns(false)
       end
 
       it 'is false' do
@@ -245,149 +242,31 @@ describe Puppet::SSL::Validator::DefaultValidator do
   describe '#has_authz_peer_cert' do
     context 'when the Root CA is listed as authorized' do
       it 'returns true when the SSL cert is issued by the Master CA' do
-        expect(subject.has_authz_peer_cert(cert_chain, [root_ca_cert])).to be_truthy
-      end
-
-      it 'returns true when the SSL cert is issued by the Agent CA' do
-        expect(subject.has_authz_peer_cert(cert_chain_agent_ca, [root_ca_cert])).to be_truthy
-      end
-    end
-
-    context 'when the Master CA is listed as authorized' do
-      it 'returns false when the SSL cert is issued by the Master CA' do
-        expect(subject.has_authz_peer_cert(cert_chain, [master_ca_cert])).to be_truthy
+        expect(subject.has_authz_peer_cert(cert_chain, [@pki[:root_cert]])).to be_truthy
       end
 
-      it 'returns true when the SSL cert is issued by the Agent CA' do
-        expect(subject.has_authz_peer_cert(cert_chain_agent_ca, [master_ca_cert])).to be_falsey
+      it 'returns true when the SSL cert is issued by the alternate CA' do
+        expect(subject.has_authz_peer_cert(cert_chain_alternate, [@pki[:root_cert]])).to be_truthy
       end
     end
 
-    context 'when the Agent CA is listed as authorized' do
-      it 'returns true when the SSL cert is issued by the Master CA' do
-        expect(subject.has_authz_peer_cert(cert_chain, [agent_ca_cert])).to be_falsey
+    context 'when one intermediate CA is listed as authorized' do
+      it 'returns true when the SSL cert is issued by the same intermediate CA' do
+        expect(subject.has_authz_peer_cert(cert_chain, [@pki[:int_cert]])).to be_truthy
       end
 
-      it 'returns true when the SSL cert is issued by the Agent CA' do
-        expect(subject.has_authz_peer_cert(cert_chain_agent_ca, [agent_ca_cert])).to be_truthy
+      it 'returns false when the SSL cert is issued by a different intermediate CA' do
+        expect(subject.has_authz_peer_cert(cert_chain_alternate, [@pki[:int_cert]])).to be_falsey
       end
     end
   end
 
-  def root_ca
-    <<-ROOT_CA
------BEGIN CERTIFICATE-----
-MIICYDCCAcmgAwIBAgIJALf2Pk2HvtBzMA0GCSqGSIb3DQEBBQUAMEkxEDAOBgNV
-BAMMB1Jvb3QgQ0ExGjAYBgNVBAsMEVNlcnZlciBPcGVyYXRpb25zMRkwFwYDVQQK
-DBBFeGFtcGxlIE9yZywgTExDMB4XDTEzMDMzMDA1NTA0OFoXDTMzMDMyNTA1NTA0
-OFowSTEQMA4GA1UEAwwHUm9vdCBDQTEaMBgGA1UECwwRU2VydmVyIE9wZXJhdGlv
-bnMxGTAXBgNVBAoMEEV4YW1wbGUgT3JnLCBMTEMwgZ8wDQYJKoZIhvcNAQEBBQAD
-gY0AMIGJAoGBAMGSpafR4lboYOPfPJC1wVHHl0gD49ZVRjOlJ9jidEUjBdFXK6SA
-S1tecDv2G4tM1ANmfMKjZl0m+KaZ8O2oq0g6kxkq1Mg0eSNvlnEyehjmTLRzHC2i
-a0biH2wMtCLzfAoXDKy4GPlciBPE9mup5I8Kien5s91t92tc7K8AJ8oBAgMBAAGj
-UDBOMB0GA1UdDgQWBBQwTdZqjjXOIFK2hOM0bcOrnhQw2jAfBgNVHSMEGDAWgBQw
-TdZqjjXOIFK2hOM0bcOrnhQw2jAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUA
-A4GBACs8EZRrzgzAlcKC1Tz8GYlNHQg0XhpbEDm+p2mOV//PuDD190O+UBpWxo9Q
-rrkkx8En0wXQZJf6iH3hwewwHLOq5yXZKbJN+SmvJvRNL95Yhyy08Y9N65tJveE7
-rPsNU/Tx19jHC87oXlmAePLI4IaUHXrWb7CRbY9TEcPdmj1R
------END CERTIFICATE-----
-    ROOT_CA
-  end
-
-  def master_ca
-    <<-MASTER_CA
------BEGIN CERTIFICATE-----
-MIICljCCAf+gAwIBAgIBAjANBgkqhkiG9w0BAQUFADBJMRAwDgYDVQQDDAdSb290
-IENBMRowGAYDVQQLDBFTZXJ2ZXIgT3BlcmF0aW9uczEZMBcGA1UECgwQRXhhbXBs
-ZSBPcmcsIExMQzAeFw0xMzAzMzAwNTUwNDhaFw0zMzAzMjUwNTUwNDhaMH4xJDAi
-BgNVBAMTG0ludGVybWVkaWF0ZSBDQSAobWFzdGVyLWNhKTEfMB0GCSqGSIb3DQEJ
-ARYQdGVzdEBleGFtcGxlLm9yZzEZMBcGA1UEChMQRXhhbXBsZSBPcmcsIExMQzEa
-MBgGA1UECxMRU2VydmVyIE9wZXJhdGlvbnMwXDANBgkqhkiG9w0BAQEFAANLADBI
-AkEAvo/az3oR69SP92jGnUHMJLEyyD1Ui1BZ/rUABJcQTRQqn3RqtlfYePWZnUaZ
-srKbXRS4q0w5Vqf1kx5w3q5tIwIDAQABo4GcMIGZMHkGA1UdIwRyMHCAFDBN1mqO
-Nc4gUraE4zRtw6ueFDDaoU2kSzBJMRAwDgYDVQQDDAdSb290IENBMRowGAYDVQQL
-DBFTZXJ2ZXIgT3BlcmF0aW9uczEZMBcGA1UECgwQRXhhbXBsZSBPcmcsIExMQ4IJ
-ALf2Pk2HvtBzMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3
-DQEBBQUAA4GBACRfa1YPS7RQUuhYovGgV0VYqxuATC7WwdIRihVh5FceSXKgSIbz
-BKmOBAy/KixEhpnHTbkpaJ0d9ITkvjMTmj3M5YMahKaQA5niVPckQPecMMd6jg9U
-l1k75xLLIcrlsDYo3999KOSSchH2K7bLT7TuQ2okdP6FHWmeWmudewlu
------END CERTIFICATE-----
-    MASTER_CA
-  end
-
-  def agent_ca
-    <<-AGENT_CA
------BEGIN CERTIFICATE-----
-MIIClTCCAf6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBJMRAwDgYDVQQDDAdSb290
-IENBMRowGAYDVQQLDBFTZXJ2ZXIgT3BlcmF0aW9uczEZMBcGA1UECgwQRXhhbXBs
-ZSBPcmcsIExMQzAeFw0xMzAzMzAwNTUwNDhaFw0zMzAzMjUwNTUwNDhaMH0xIzAh
-BgNVBAMTGkludGVybWVkaWF0ZSBDQSAoYWdlbnQtY2EpMR8wHQYJKoZIhvcNAQkB
-FhB0ZXN0QGV4YW1wbGUub3JnMRkwFwYDVQQKExBFeGFtcGxlIE9yZywgTExDMRow
-GAYDVQQLExFTZXJ2ZXIgT3BlcmF0aW9uczBcMA0GCSqGSIb3DQEBAQUAA0sAMEgC
-QQDkEj/Msmi4hJImxP5+ocixMTHuYC1M1E2p4QcuzOkZYrfHf+5hJMcahfYhLiXU
-jHBredOXhgSisHh6CLSb/rKzAgMBAAGjgZwwgZkweQYDVR0jBHIwcIAUME3Wao41
-ziBStoTjNG3Dq54UMNqhTaRLMEkxEDAOBgNVBAMMB1Jvb3QgQ0ExGjAYBgNVBAsM
-EVNlcnZlciBPcGVyYXRpb25zMRkwFwYDVQQKDBBFeGFtcGxlIE9yZywgTExDggkA
-t/Y+TYe+0HMwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAQYwDQYJKoZIhvcN
-AQEFBQADgYEAujSj9rxIxJHEuuYXb15L30yxs9Tdvy4OCLiKdjvs9Z7gG8Pbutls
-ooCwyYAkmzKVs/8cYjZJnvJrPEW1gFwqX7Xknp85Cfrl+/pQEPYq5sZVa5BIm9tI
-0EvlDax/Hd28jI6Bgq5fsTECNl9GDGknCy7vwRZem0h+hI56lzR3pYE=
------END CERTIFICATE-----
-    AGENT_CA
-  end
-
-  # Signed by the master CA (Good)
-  def master_issued_by_master_ca
-<<-GOOD_SSL_CERT
------BEGIN CERTIFICATE-----
-MIICZzCCAhGgAwIBAgIBATANBgkqhkiG9w0BAQUFADB+MSQwIgYDVQQDExtJbnRl
-cm1lZGlhdGUgQ0EgKG1hc3Rlci1jYSkxHzAdBgkqhkiG9w0BCQEWEHRlc3RAZXhh
-bXBsZS5vcmcxGTAXBgNVBAoTEEV4YW1wbGUgT3JnLCBMTEMxGjAYBgNVBAsTEVNl
-cnZlciBPcGVyYXRpb25zMB4XDTEzMDMzMDA1NTA0OFoXDTMzMDMyNTA1NTA0OFow
-HjEcMBoGA1UEAwwTbWFzdGVyMS5leGFtcGxlLm9yZzBcMA0GCSqGSIb3DQEBAQUA
-A0sAMEgCQQDACW8fryVZH0dC7vYUASonVBKYcILnKN2O9QX7RenZGN1TWek9LQxr
-yQFDyp7WJ8jUw6nENGniLU8J+QSSxryjAgMBAAGjgdkwgdYwWwYDVR0jBFQwUqFN
-pEswSTEQMA4GA1UEAwwHUm9vdCBDQTEaMBgGA1UECwwRU2VydmVyIE9wZXJhdGlv
-bnMxGTAXBgNVBAoMEEV4YW1wbGUgT3JnLCBMTEOCAQIwDAYDVR0TAQH/BAIwADAL
-BgNVHQ8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMD0GA1Ud
-EQQ2MDSCE21hc3RlcjEuZXhhbXBsZS5vcmeCB21hc3RlcjGCBnB1cHBldIIMcHVw
-cGV0bWFzdGVyMA0GCSqGSIb3DQEBBQUAA0EAo8PvgLrah6jQVs6YCBxOTn13PDip
-fVbcRsFd0dtIr00N61bCqr6Fa0aRwy424gh6bVJTNmk2zoaH7r025dZRhw==
------END CERTIFICATE-----
-GOOD_SSL_CERT
-  end
-
-  # Signed by the agent CA, not the master CA (Rogue)
-  def master_issued_by_agent_ca
-<<-BAD_SSL_CERT
------BEGIN CERTIFICATE-----
-MIICZjCCAhCgAwIBAgIBBDANBgkqhkiG9w0BAQUFADB9MSMwIQYDVQQDExpJbnRl
-cm1lZGlhdGUgQ0EgKGFnZW50LWNhKTEfMB0GCSqGSIb3DQEJARYQdGVzdEBleGFt
-cGxlLm9yZzEZMBcGA1UEChMQRXhhbXBsZSBPcmcsIExMQzEaMBgGA1UECxMRU2Vy
-dmVyIE9wZXJhdGlvbnMwHhcNMTMwMzMwMDU1MDQ4WhcNMzMwMzI1MDU1MDQ4WjAe
-MRwwGgYDVQQDDBNtYXN0ZXIxLmV4YW1wbGUub3JnMFwwDQYJKoZIhvcNAQEBBQAD
-SwAwSAJBAPnCDnryLLXWepGLqsdBWlytfeakE/yijM8GlE/yT0SbpJInIhJR1N1A
-0RskriHrxTU5qQEhd0RIja7K5o4NYksCAwEAAaOB2TCB1jBbBgNVHSMEVDBSoU2k
-SzBJMRAwDgYDVQQDDAdSb290IENBMRowGAYDVQQLDBFTZXJ2ZXIgT3BlcmF0aW9u
-czEZMBcGA1UECgwQRXhhbXBsZSBPcmcsIExMQ4IBATAMBgNVHRMBAf8EAjAAMAsG
-A1UdDwQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwPQYDVR0R
-BDYwNIITbWFzdGVyMS5leGFtcGxlLm9yZ4IHbWFzdGVyMYIGcHVwcGV0ggxwdXBw
-ZXRtYXN0ZXIwDQYJKoZIhvcNAQEFBQADQQA841IzHLlnn4RIJ0/BOZ/16iWC1dNr
-jV9bELC5OxeMNSsVXbFNeTHwbHEYjDg5dQ6eUkxPdBSMWBeQwe2Mw+xG
------END CERTIFICATE-----
-BAD_SSL_CERT
-  end
-
   def cert_chain
-    [ master_issued_by_master_ca, master_ca, root_ca ].map do |pem|
-      OpenSSL::X509::Certificate.new(pem)
-    end
+    [@pki[:int_node_cert], @pki[:int_cert], @pki[:root_cert]]
   end
 
-  def cert_chain_agent_ca
-    [ master_issued_by_agent_ca, agent_ca, root_ca ].map do |pem|
-      OpenSSL::X509::Certificate.new(pem)
-    end
+  def cert_chain_alternate
+    [@pki[:unrevoked_leaf_node_cert], @pki[:leaf_cert], @pki[:revoked_int_cert], @pki[:root_cert]]
   end
 
   def cert_chain_in_callback_order
@@ -399,22 +278,10 @@ BAD_SSL_CERT
   end
 
   let :expected_authz_error_msg do
-    authz_ca_certs = ssl_configuration.ca_auth_certificates
+    authz_ca_certs = subject.decode_cert_bundle(subject.read_file)
     msg = authz_error_prefix
     msg << "Authorized Issuers: #{authz_ca_certs.collect {|c| c.subject}.join(', ')}  "
     msg << "Peer Chain: #{cert_chain.collect {|c| c.subject}.join(' => ')}"
     msg
   end
-
-  let :root_ca_cert do
-    OpenSSL::X509::Certificate.new(root_ca)
-  end
-
-  let :master_ca_cert do
-    OpenSSL::X509::Certificate.new(master_ca)
-  end
-
-  let :agent_ca_cert do
-    OpenSSL::X509::Certificate.new(agent_ca)
-  end
 end