puppet 5.5.22 → 6.0.0

data/lib/puppet/settings.rb

@@ -84,46 +84,6 @@ class Puppet::Settings
     "puppet.conf"
   end
 
-  def stringify_settings(section, settings = :all)
-    values_from_the_selected_section =
-      values(nil, section.to_sym)
-
-    loader_settings = {
-      :environmentpath => values_from_the_selected_section.interpolate(:environmentpath),
-      :basemodulepath => values_from_the_selected_section.interpolate(:basemodulepath),
-    }
-
-    Puppet.override(Puppet.base_context(loader_settings),
-                    _("New environment loaders generated from the requested section.")) do
-      # And now we can lookup values that include those from environments configured from
-      # the requested section
-      values = values(Puppet[:environment].to_sym, section.to_sym)
-
-      to_be_rendered = {}
-      settings = Puppet.settings.to_a.collect(&:first) if settings == :all
-      settings.sort.each do |setting_name|
-        to_be_rendered[setting_name] = values.print(setting_name.to_sym)
-      end
-
-      stringifyhash(to_be_rendered)
-    end
-  end
-
-  def stringifyhash(hash)
-    newhash = {}
-    hash.each do |key, val|
-      key = key.to_s
-      if val.is_a? Hash
-        newhash[key] = stringifyhash(val)
-      elsif val.is_a? Symbol
-        newhash[key] = val.to_s
-      else
-        newhash[key] = val
-      end
-    end
-    newhash
-  end
-
   # Create a new collection of config settings.
   def initialize
     @config = {}
@@ -295,7 +255,7 @@ class Puppet::Settings
     @global_defaults_initialized
   end
 
-  def initialize_global_settings(args = [], require_config = true)
+  def initialize_global_settings(args = [])
     raise Puppet::DevError, _("Attempting to initialize global default settings more than once!") if global_defaults_initialized?
 
     # The first two phases of the lifecycle of a puppet application are:
@@ -304,7 +264,7 @@ class Puppet::Settings
     # 2) Parse the puppet config file(s).
 
     parse_global_options(args)
-    parse_config_files(require_config)
+    parse_config_files
 
     @global_defaults_initialized = true
   end
@@ -630,19 +590,14 @@ class Puppet::Settings
   end
 
   # Parse the configuration file.  Just provides thread safety.
-  def parse_config_files(require_config = true)
+  def parse_config_files
     file = which_configuration_file
     if Puppet::FileSystem.exist?(file)
       begin
         text = read_file(file)
       rescue => detail
-        message = _("Could not load %{file}: %{detail}") % { file: file, detail: detail}
-        if require_config
-          Puppet.log_and_raise(detail, message)
-        else
-          Puppet.log_exception(detail, message)
-          return
-        end
+        Puppet.log_exception(detail, "Could not load #{file}: #{detail}")
+        return
       end
     else
       return
@@ -1229,10 +1184,10 @@ Generated on #{Time.now}.
       if !Puppet::FileSystem.symlink?(configured_environment_path)
         parameters = { :ensure => 'directory' }
         unless Puppet::FileSystem.exist?(configured_environment_path)
-          parameters[:mode] = '0750'
+          parameters.merge!(:mode => '0750')
           if Puppet.features.root?
-            parameters[:owner] = Puppet[:user] if service_user_available?
-            parameters[:group] = Puppet[:group] if service_group_available?
+            parameters.merge!(:owner => Puppet[:user]) if service_user_available?
+            parameters.merge!(:group => Puppet[:group]) if service_group_available?
           end
         end
         catalog.add_resource(Puppet::Resource.new(:file, configured_environment_path, :parameters => parameters))
@@ -1242,7 +1197,7 @@ Generated on #{Time.now}.
 
   def add_user_resources(catalog, sections)
     return unless Puppet.features.root?
-    return if Puppet.features.microsoft_windows?
+    return if Puppet::Util::Platform.windows?
     return unless self[:mkusers]
 
     @config.each do |name, setting|

data/lib/puppet/settings/config_file.rb

@@ -25,8 +25,7 @@ class Puppet::Settings::ConfigFile
       allowed_section_names << 'main' unless allowed_section_names.include?('main')
     end
 
-    # in Ruby 1.9.3 strings are not UTF-8 by default, so ensure text is treated properly
-    ini = Puppet::Settings::IniFile.parse(StringIO.new(text).set_encoding(Encoding::UTF_8))
+    ini = Puppet::Settings::IniFile.parse(text.encode(Encoding::UTF_8))
     unique_sections_in(ini, file, allowed_section_names).each do |section_name|
       section = Section.new(section_name.to_sym)
       result.with_section(section)

data/lib/puppet/settings/environment_conf.rb

@@ -159,7 +159,6 @@ class Puppet::Settings::EnvironmentConf
 
     return valid
   end
-  private_class_method :validate
 
   def get_setting(setting_name, default = nil)
     value = raw_setting(setting_name)

data/lib/puppet/settings/file_setting.rb

@@ -156,7 +156,7 @@ class Puppet::Settings::FileSetting < Puppet::Settings::StringSetting
       end
 
       # REMIND fails on Windows because chown/chgrp functionality not supported yet
-      if Puppet.features.root? and !Puppet.features.microsoft_windows?
+      if Puppet.features.root? and !Puppet::Util::Platform.windows?
         resource[:owner] = self.owner if self.owner
         resource[:group] = self.group if self.group
       end

data/lib/puppet/settings/server_list_setting.rb

@@ -4,15 +4,6 @@ class Puppet::Settings::ServerListSetting < Puppet::Settings::ArraySetting
     :server_list
   end
 
-  def print(value)
-    if value.is_a?(Array)
-      #turn into a string
-      value.map {|item| item.join(":") }.join(",")
-    else
-      value
-    end
-  end
-  
   def munge(value)
     servers = super 
     servers.map! { |server| 

data/lib/puppet/ssl.rb

@@ -4,7 +4,6 @@ require 'openssl'
 
 module Puppet::SSL # :nodoc:
   CA_NAME = "ca"
-  require 'puppet/ssl/configuration'
   require 'puppet/ssl/host'
   require 'puppet/ssl/oids'
   require 'puppet/ssl/validator'

data/lib/puppet/ssl/base.rb

@@ -34,11 +34,6 @@ class Puppet::SSL::Base
 
   attr_accessor :name, :content
 
-  # Is this file for the CA?
-  def ca?
-    name == Puppet::SSL::Host.ca_name
-  end
-
   def generate
     raise Puppet::DevError, _("%{class_name} did not override 'generate'") % { class_name: self.class }
   end
@@ -86,18 +81,15 @@ class Puppet::SSL::Base
 
   # Read content from disk appropriately.
   def read(path)
-    # applies to Puppet::SSL::Certificate, Puppet::SSL::CertificateRequest, Puppet::SSL::CertificateRevocationList
+    # applies to Puppet::SSL::Certificate, Puppet::SSL::CertificateRequest
     # Puppet::SSL::Key uses this, but also provides its own override
     # nothing derives from Puppet::SSL::Certificate, but it is called by a number of other SSL Indirectors:
-    # Puppet::SSL::Certificate::DisabledCa (:find, :save, :destroy)
     # Puppet::Indirector::CertificateStatus::File (.indirection.find)
     # Puppet::Network::HTTP::WEBrick (.indirection.find)
     # Puppet::Network::HTTP::RackREST (.from_instance)
     # Puppet::Network::HTTP::WEBrickREST (.from_instance)
-    # Puppet::SSL::CertificateAuthority (.new, .indirection.find, .indirection.save)
     # Puppet::SSL::Host (.indirection.find)
     # Puppet::SSL::Inventory (.indirection.search, implements its own add / rebuild / serials with encoding UTF8)
-    # Puppet::SSL::CertificateAuthority::Interface (.indirection.find)
     # Puppet::SSL::Validator::DefaultValidator (.from_instance) / Puppet::SSL::Validator::NoValidator does nothing
     @content = wrapped_class.new(Puppet::FileSystem.read(path, :encoding => Encoding::ASCII))
   end

data/lib/puppet/ssl/certificate.rb

@@ -21,12 +21,16 @@ DOC
     [:s]
   end
 
-  def subject_alt_names
-    alts = content.extensions.find{|ext| ext.oid == "subjectAltName"}
+  def self.subject_alt_names_for(cert)
+    alts = cert.extensions.find{|ext| ext.oid == "subjectAltName"}
     return [] unless alts
     alts.value.split(/\s*,\s*/)
   end
 
+  def subject_alt_names
+    self.class.subject_alt_names_for(content)
+  end
+
   def expiration
     return nil unless content
     content.not_after
@@ -50,8 +54,7 @@ DOC
   def custom_extensions
     custom_exts = content.extensions.select do |ext|
       Puppet::SSL::Oids.subtree_of?('ppRegCertExt', ext.oid) or
-        Puppet::SSL::Oids.subtree_of?('ppPrivCertExt', ext.oid) or
-        Puppet::SSL::Oids.subtree_of?('ppAuthCertExt', ext.oid)
+        Puppet::SSL::Oids.subtree_of?('ppPrivCertExt', ext.oid)
     end
 
     custom_exts.map do |ext|

data/lib/puppet/ssl/certificate_request.rb

@@ -30,19 +30,7 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
 
   extend Puppet::Indirector
 
-  # If auto-signing is on, sign any certificate requests as they are saved.
-  module AutoSigner
-    def save(instance, key = nil)
-      super
-
-      # Try to autosign the CSR.
-      if ca = Puppet::SSL::CertificateAuthority.instance
-        ca.autosign(instance)
-      end
-    end
-  end
-
-  indirects :certificate_request, :terminus_class => :file, :extend => AutoSigner, :doc => <<DOC
+  indirects :certificate_request, :terminus_class => :file, :doc => <<DOC
     This indirection wraps an `OpenSSL::X509::Request` object, representing a certificate signing request (CSR).
     The indirection key is the certificate CN (generally a hostname).
 DOC
@@ -103,7 +91,11 @@ DOC
     raise Puppet::Error, _("CSR sign verification failed; you need to clean the certificate request for %{name} on the server") % { name: name } unless csr.verify(key.public_key)
 
     @content = csr
-    Puppet.info _("Certificate Request fingerprint (%{digest}): %{hex_digest}") % { digest: digest.name, hex_digest: digest.to_hex }
+
+    # we won't be able to get the digest on jruby
+    if @content.signature_algorithm
+      Puppet.info _("Certificate Request fingerprint (%{digest}): %{hex_digest}") % { digest: digest.name, hex_digest: digest.to_hex }
+    end
     @content
   end
 

data/lib/puppet/ssl/certificate_request_attributes.rb

@@ -21,7 +21,7 @@ class Puppet::SSL::CertificateRequestAttributes
   def load
     Puppet.info(_("csr_attributes file loading from %{path}") % { path: path })
     if Puppet::FileSystem.exist?(path)
-      hash = Puppet::Util::Yaml.load_file(path, {})
+      hash = Puppet::Util::Yaml.safe_load_file(path, [Symbol]) || {}
       if ! hash.is_a?(Hash)
         raise Puppet::Error, _("invalid CSR attributes, expected instance of Hash, received instance of %{klass}") % { klass: hash.class }
       end

data/lib/puppet/ssl/host.rb

@@ -1,10 +1,18 @@
-require 'puppet/indirector'
 require 'puppet/ssl'
 require 'puppet/ssl/key'
 require 'puppet/ssl/certificate'
 require 'puppet/ssl/certificate_request'
-require 'puppet/ssl/certificate_revocation_list'
 require 'puppet/ssl/certificate_request_attributes'
+require 'puppet/rest/errors'
+require 'puppet/rest/routes'
+require 'puppet/rest/ssl_context'
+begin
+  # This may fail when being loaded from Puppet Server. However loading the
+  # client monkey patches the SSL Store and we need to have those monkey
+  # patches in as soon as possible on the agent.
+  require 'puppet/rest/client'
+rescue LoadError
+end
 
 # The class that manages all aspects of our SSL certificates --
 # private keys, public keys, requests, etc.
@@ -14,21 +22,10 @@ class Puppet::SSL::Host
   CA_NAME = Puppet::SSL::CA_NAME
   Certificate = Puppet::SSL::Certificate
   CertificateRequest = Puppet::SSL::CertificateRequest
-  CertificateRevocationList = Puppet::SSL::CertificateRevocationList
-
-  extend Puppet::Indirector
-  indirects :certificate_status, :terminus_class => :file, :doc => <<DOC
-    This indirection represents the host that ties a key, certificate, and certificate request together.
-    The indirection key is the certificate CN (generally a hostname).
-DOC
-
-  attr_reader :name
-  attr_accessor :ca
 
-  attr_writer :key, :certificate, :certificate_request
+  attr_reader :name, :crl_path
 
-  # This accessor is used in instances for indirector requests to hold desired state
-  attr_accessor :desired_state
+  attr_writer :key, :certificate, :certificate_request, :crl_usage
 
   def self.localhost
     return @localhost if @localhost
@@ -42,28 +39,10 @@ DOC
     @localhost = nil
   end
 
-  # This is the constant that people will use to mark that a given host is
-  # a certificate authority.
-  def self.ca_name
-    CA_NAME
-  end
-
-  class << self
-    attr_reader :ca_location
-  end
-
   # Configure how our various classes interact with their various terminuses.
   def self.configure_indirection(terminus, cache = nil)
     Certificate.indirection.terminus_class = terminus
     CertificateRequest.indirection.terminus_class = terminus
-    CertificateRevocationList.indirection.terminus_class = terminus
-
-    host_map = {:ca => :file, :disabled_ca => nil, :file => nil, :rest => :rest}
-    if term = host_map[terminus]
-      self.indirection.terminus_class = term
-    else
-      self.indirection.reset_terminus_class
-    end
 
     if cache
       # This is weird; we don't actually cache our keys, we
@@ -77,7 +56,6 @@ DOC
     if cache
       Certificate.indirection.cache_class = cache
       CertificateRequest.indirection.cache_class = cache
-      CertificateRevocationList.indirection.cache_class = cache
     else
       # Make sure we have no cache configured.  puppet master
       # switches the configurations around a bit, so it's important
@@ -85,39 +63,9 @@ DOC
       # time.
       Certificate.indirection.cache_class = nil
       CertificateRequest.indirection.cache_class = nil
-      CertificateRevocationList.indirection.cache_class = nil
     end
   end
 
-  CA_MODES = {
-    # Our ca is local, so we use it as the ultimate source of information
-    # And we cache files locally.
-    :local => [:ca, :file],
-    # We're a remote CA client.
-    :remote => [:rest, :file],
-    # We are the CA, so we don't have read/write access to the normal certificates.
-    :only => [:ca],
-    # We have no CA, so we just look in the local file store.
-    :none => [:disabled_ca]
-  }
-
-  # Specify how we expect to interact with our certificate authority.
-  def self.ca_location=(mode)
-    modes = CA_MODES.collect { |m, vals| m.to_s }.join(", ")
-    raise ArgumentError, _("CA Mode can only be one of: %{modes}") % { modes: modes } unless CA_MODES.include?(mode)
-
-    @ca_location = mode
-
-    configure_indirection(*CA_MODES[@ca_location])
-  end
-
-  # Puppet::SSL::Host is actually indirected now so the original implementation
-  # has been moved into the certificate_status indirector.  This method is in-use
-  # in `puppet cert -c <certname>`.
-  def self.destroy(name)
-    indirection.destroy(name)
-  end
-
   def self.from_data_hash(data)
     instance = new(data["name"])
     if data["desired_state"]
@@ -126,18 +74,6 @@ DOC
     instance
   end
 
-  # Puppet::SSL::Host is actually indirected now so the original implementation
-  # has been moved into the certificate_status indirector.  This method does not
-  # appear to be in use in `puppet cert -l`.
-  def self.search(options = {})
-    indirection.search("*", options)
-  end
-
-  # Is this a ca host, meaning that all of its files go in the CA location?
-  def ca?
-    ca
-  end
-
   def key
     @key ||= Key.indirection.find(name)
   end
@@ -156,10 +92,6 @@ DOC
     true
   end
 
-  def certificate_request
-    @certificate_request ||= CertificateRequest.indirection.find(name)
-  end
-
   # Our certificate request requires the key but that's all.
   def generate_certificate_request(options = {})
     generate_key unless key
@@ -169,8 +101,6 @@ DOC
       # ...add our configured dns_alt_names
       if Puppet[:dns_alt_names] and Puppet[:dns_alt_names] != ''
         options[:dns_alt_names] ||= Puppet[:dns_alt_names]
-      elsif Puppet::SSL::CertificateAuthority.ca? and fqdn = Facter.value(:fqdn) and domain = Facter.value(:domain)
-        options[:dns_alt_names] = "puppet, #{fqdn}, puppet.#{domain}"
       end
     end
 
@@ -183,7 +113,8 @@ DOC
     @certificate_request = CertificateRequest.new(name)
     @certificate_request.generate(key.content, options)
     begin
-      CertificateRequest.indirection.save(@certificate_request)
+      submit_certificate_request(@certificate_request)
+      save_certificate_request(@certificate_request)
     rescue
       @certificate_request = nil
       raise
@@ -192,25 +123,38 @@ DOC
     true
   end
 
+  def http_client(ssl_context)
+    Puppet::Rest::Client.new(ssl_context: ssl_context)
+  end
+
   def certificate
     unless @certificate
       generate_key unless key
 
       # get the CA cert first, since it's required for the normal cert
-      # to be of any use.
-      return nil unless Certificate.indirection.find("ca", :fail_on_404 => true) unless ca?
-      return nil unless @certificate = Certificate.indirection.find(name)
+      # to be of any use. If we can't get it, quit.
+      if !ensure_ca_certificate
+        return nil
+      end
+
+      cert = get_host_certificate
+      return nil unless cert
 
-      validate_certificate_with_key
+      validate_certificate_with_key(cert)
+      @certificate = cert
     end
     @certificate
   end
 
-  def validate_certificate_with_key
-    raise Puppet::Error, _("No certificate to validate.") unless certificate
-    raise Puppet::Error, _("No private key with which to validate certificate with fingerprint: %{fingerprint}") % { fingerprint: certificate.fingerprint } unless key
-    unless certificate.content.check_private_key(key.content)
-      raise Puppet::Error, _(<<ERROR_STRING) % { fingerprint: certificate.fingerprint, cert_name: Puppet[:certname], ssl_dir: Puppet[:ssldir], cert_dir: Puppet[:certdir].tr('/', '\\') }
+  # Validate that our private key matches the specified certificate.
+  #
+  # @param [Puppet::SSL::Certificate] cert the certificate to check
+  # @raises [Puppet::Error] if the private key does not match
+  def validate_certificate_with_key(cert)
+    raise Puppet::Error, _("No certificate to validate.") unless cert
+    raise Puppet::Error, _("No private key with which to validate certificate with fingerprint: %{fingerprint}") % { fingerprint: cert.fingerprint } unless key
+    unless cert.content.check_private_key(key.content)
+      raise Puppet::Error, _(<<ERROR_STRING) % { fingerprint: cert.fingerprint, cert_name: Puppet[:certname], ssl_dir: Puppet[:ssldir], cert_dir: Puppet[:certdir].gsub('/', '\\') }
 The certificate retrieved from the master does not match the agent's private key. Did you forget to run as root?
 Certificate fingerprint: %{fingerprint}
 To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certificate.
@@ -224,18 +168,93 @@ ERROR_STRING
     end
   end
 
+  def download_host_certificate
+    cert = download_certificate_from_ca(name)
+    return nil unless cert
+
+    validate_certificate_with_key(cert)
+    save_host_certificate(cert)
+    cert
+  end
+
+  # Search for an existing CSR for this host either cached on
+  # disk or stored by the CA. Returns nil if no request exists.
+  # @return [Puppet::SSL::CertificateRequest, nil]
+  def certificate_request
+    unless @certificate_request
+      if csr = load_certificate_request_from_file
+        @certificate_request = csr
+      elsif csr = download_csr_from_ca
+        @certificate_request = csr
+      end
+    end
+    @certificate_request
+  end
+
   # Generate all necessary parts of our ssl host.
   def generate
     generate_key unless key
-    # ask indirector to find any existing requests and download them
+
     existing_request = certificate_request
 
     # if CSR downloaded from master, but the local keypair was just generated and
     # does not match the public key in the CSR, fail hard
-    if !existing_request.nil? &&
-      (key.content.public_key.to_s != existing_request.content.public_key.to_s)
+    validate_csr_with_key(existing_request, key) if existing_request
+
+    generate_certificate_request unless existing_request
+  end
 
-      raise Puppet::Error, _(<<ERROR_STRING) % { fingerprint: existing_request.fingerprint, csr_public_key: existing_request.content.public_key.to_text, agent_public_key: key.content.public_key.to_text, cert_name: Puppet[:certname], ssl_dir: Puppet[:ssldir], cert_dir: Puppet[:certdir].tr('/', '\\') }
+  # Generate a keypair, generate a CSR, and submit it. If a local key pair
+  # already exists it will be used to generate the CSR. If a local CSR already
+  # exists and matches the key then the existing CSR will be submitted. If the
+  # CSR and key do not match an exception will be raised.
+  #
+  # @return [Puppet::SSL::CertificateRequest, nil]
+  def submit_request
+    generate_key unless key
+
+    csr = load_certificate_request_from_file
+    if csr
+      if key.content.public_key.to_s != csr.content.public_key.to_s
+        Puppet.warning("The local CSR does not match the agent's public key. Generating a new CSR.")
+
+        request_path = certificate_request_location(name)
+        Puppet::FileSystem.unlink(request_path)
+        csr = nil
+      end
+    end
+
+    if csr
+      validate_csr_with_key(csr, key)
+      submit_certificate_request(csr)
+      @certificate_request = csr
+    else
+      generate_certificate_request
+    end
+
+    @certificate_request
+  end
+
+  def validate_local_csr_with_key(csr, key)
+    if key.content.public_key.to_s != csr.content.public_key.to_s
+      raise Puppet::Error, _(<<ERROR_STRING) % { fingerprint: csr.fingerprint, csr_public_key: csr.content.public_key.to_text, agent_public_key: key.content.public_key.to_text, cert_name: Puppet[:certname], ssl_dir: Puppet[:ssldir], cert_dir: Puppet[:certdir].gsub('/', '\\') }
+The local CSR does not match the agent's public key.
+CSR fingerprint: %{fingerprint}
+CSR public key: %{csr_public_key}
+Agent public key: %{agent_public_key}
+To fix this, remove the CSR from the agent and then start a puppet run, which will automatically regenerate a CSR.
+On the agent:
+  1a. On most platforms: find %{ssl_dir} -name %{cert_name}.pem -delete
+  1b. On Windows: del "%{cert_dir}\\%{cert_name}.pem" /f
+  2. puppet agent -t
+ERROR_STRING
+    end
+  end
+  private :validate_local_csr_with_key
+
+  def validate_csr_with_key(csr, key)
+    if key.content.public_key.to_s != csr.content.public_key.to_s
+      raise Puppet::Error, _(<<ERROR_STRING) % { fingerprint: csr.fingerprint, csr_public_key: csr.content.public_key.to_text, agent_public_key: key.content.public_key.to_text, cert_name: Puppet[:certname], ssl_dir: Puppet[:ssldir], cert_dir: Puppet[:certdir].gsub('/', '\\') }
 The CSR retrieved from the master does not match the agent's public key.
 CSR fingerprint: %{fingerprint}
 CSR public key: %{csr_public_key}
@@ -249,21 +268,15 @@ On the agent:
   2. puppet agent -t
 ERROR_STRING
     end
-    generate_certificate_request unless existing_request
-
-    # If we can get a CA instance, then we're a valid CA, and we
-    # should use it to sign our request; else, just try to read
-    # the cert.
-    if ! certificate and ca = Puppet::SSL::CertificateAuthority.instance
-      ca.sign(self.name, {allow_dns_alt_names: true})
-    end
   end
+  private :validate_csr_with_key
 
   def initialize(name = nil)
     @name = (name || Puppet[:certname]).downcase
     Puppet::SSL::Base.validate_certname(@name)
     @key = @certificate = @certificate_request = nil
-    @ca = (name == self.class.ca_name)
+    @crl_usage = Puppet.settings[:certificate_revocation]
+    @crl_path = Puppet.settings[:hostcrl]
   end
 
   # Extract the public key from the private key.
@@ -271,6 +284,14 @@ ERROR_STRING
     key.content.public_key
   end
 
+  def use_crl?
+    !!@crl_usage
+  end
+
+  def use_crl_chain?
+    @crl_usage == true || @crl_usage == :chain
+  end
+
   # Create/return a store that uses our SSL info to validate
   # connections.
   def ssl_store(purpose = OpenSSL::X509::PURPOSE_ANY)
@@ -280,49 +301,6 @@ ERROR_STRING
     @ssl_store
   end
 
-  def to_data_hash
-    my_cert = Puppet::SSL::Certificate.indirection.find(name)
-    result = { 'name'  => name }
-
-    my_state = state
-
-    result['state'] = my_state
-    result['desired_state'] = desired_state if desired_state
-
-    thing_to_use = (my_state == 'requested') ? certificate_request : my_cert
-
-    # this is for backwards-compatibility
-    # we should deprecate it and transition people to using
-    # json[:fingerprints][:default]
-    # It appears that we have no internal consumers of this api
-    # --jeffweiss 30 aug 2012
-    result['fingerprint'] = thing_to_use.fingerprint
-
-    # The above fingerprint doesn't tell us what message digest algorithm was used
-    # No problem, except that the default is changing between 2.7 and 3.0. Also, as
-    # we move to FIPS 140-2 compliance, MD5 is no longer allowed (and, gasp, will
-    # segfault in rubies older than 1.9.3)
-    # So, when we add the newer fingerprints, we're explicit about the hashing
-    # algorithm used.
-    # --jeffweiss 31 july 2012
-    result['fingerprints'] = {}
-    result['fingerprints']['default'] = thing_to_use.fingerprint
-
-    suitable_message_digest_algorithms.each do |md|
-      result['fingerprints'][md.to_s] = thing_to_use.fingerprint md
-    end
-    result['dns_alt_names'] = thing_to_use.subject_alt_names
-
-    result
-  end
-
-  # eventually we'll probably want to move this somewhere else or make it
-  # configurable
-  # --jeffweiss 29 aug 2012
-  def suitable_message_digest_algorithms
-    [:SHA1, :SHA224, :SHA256, :SHA384, :SHA512]
-  end
-
   # Attempt to retrieve a cert, if we don't already have one.
   def wait_for_cert(time)
     begin
@@ -345,7 +323,7 @@ ERROR_STRING
       exit(1)
     end
 
-    loop do
+    while true
       sleep time
       begin
         break if certificate
@@ -356,45 +334,293 @@ ERROR_STRING
     end
   end
 
-  def state
-    if certificate_request
-      return 'requested'
+  # Saves the given certificate to disc, at a location determined by this
+  # host's configuration.
+  # @param [Puppet::SSL::Certificate] cert the cert to save
+  def save_host_certificate(cert)
+    file_path = certificate_location(name)
+    Puppet::Util.replace_file(file_path, 0644) do |f|
+      f.write(cert.to_s)
+    end
+  end
+
+  private
+
+  # Load a previously generated CSR from disk
+  # @return [Puppet::SSL::CertificateRequest, nil]
+  def load_certificate_request_from_file
+    request_path = certificate_request_location(name)
+    if Puppet::FileSystem.exist?(request_path)
+      Puppet::SSL::CertificateRequest.from_s(Puppet::FileSystem.read(request_path))
     end
+  end
 
+  # Download the CSR for this host from the CA. Returns nil if the CA
+  # has no saved CSR for this host.
+  # @raises [Puppet::Error] if the response from the server is not a valid
+  #                         CSR or an error occurs while fetching.
+  # @return [Puppet::SSL::CertificateRequest, nil]
+  def download_csr_from_ca
     begin
-      Puppet::SSL::CertificateAuthority.new.verify(name)
-      return 'signed'
-    rescue Puppet::SSL::CertificateAuthority::CertificateVerificationError
-      return 'revoked'
+      body = Puppet::Rest::Routes.get_certificate_request(
+                    name, Puppet::Rest::SSLContext.new(OpenSSL::SSL::VERIFY_PEER, ssl_store))
+      begin
+        Puppet::SSL::CertificateRequest.from_s(body)
+      rescue OpenSSL::X509::RequestError => e
+        raise Puppet::Error, _("Response from the CA did not contain a valid certificate request: %{message}") % { message: e.message }
+      end
+    rescue Puppet::Rest::ResponseError => e
+      if e.response.code.to_i == 404
+        nil
+      else
+        raise Puppet::Error, _('Could not download certificate request: %{message}') % { message: e.message }
+      end
     end
   end
+  # Submit the CSR to the CA via an HTTP PUT request.
+  # @param [Puppet::SSL::CertificateRequest] csr the request to submit
+  def submit_certificate_request(csr)
+    Puppet::Rest::Routes.put_certificate_request(
+                  csr.render, name, Puppet::Rest::SSLContext.new(OpenSSL::SSL::VERIFY_PEER, ssl_store))
+  end
 
-  private
+  def save_certificate_request(csr)
+    Puppet::Util.replace_file(certificate_request_location(name), 0644) do |file|
+      file.write(csr.render)
+    end
+  end
+
+  # @param crl_string [String] CRLs read from disk or obtained from server
+  # @return [Array<OpenSSL::X509::CRL>] CRLs from chain
+  # @raise [Puppet::Error<OpenSSL::X509::CRLError>] if the CRL chain is malformed
+  def process_crl_string(crl_string)
+    delimiters = /-----BEGIN X509 CRL-----.*?-----END X509 CRL-----/m
+    crl_string.scan(delimiters).map do |crl|
+      begin
+        OpenSSL::X509::CRL.new(crl)
+      rescue OpenSSL::X509::CRLError => e
+        raise Puppet::Error.new(
+          _("Failed attempting to load CRL from %{crl_path}! The CRL below caused the error '%{error}':\n%{crl}" % {crl_path: crl_path, error: e.message, crl: crl}),
+          e)
+      end
+    end
+  end
+
+  # @param path [String] Path to CRL Chain
+  # @return [Array<OpenSSL::X509::CRL>] CRLs from chain
+  # @raise [Puppet::Error<OpenSSL::X509::CRLError>] if the CRL chain is malformed
+  def load_crls(path)
+    crls_pems = Puppet::FileSystem.read(path, encoding: Encoding::UTF_8)
+    process_crl_string(crls_pems)
+  end
+
+  # Ensures that the CA certificate is available for either generating or
+  # validating the host's cert.
+  # It will first check on disk, then try to download it.
+  # @raise [Puppet::Error] if text form of found certificate bundle is invalid
+  #                        and cannot be loaded into cert objects
+  # @return [Boolean] true if the CA certificate was found, false otherwise
+  def ensure_ca_certificate
+    file_path = certificate_location(CA_NAME)
+    if Puppet::FileSystem.exist?(file_path)
+      begin
+        # This load ensures that the file contents is a valid cert bundle.
+        # If the text is malformed, load_certificate_bundle will raise.
+        load_certificate_bundle(Puppet::FileSystem.read(file_path))
+      rescue Puppet::Error => e
+        raise Puppet::Error, _("The CA certificate at %{file_path} is invalid: %{message}") % { file_path: file_path, message: e.message }
+      end
+    else
+      bundle = download_ca_certificate_bundle
+      if bundle
+        save_bundle(bundle, certificate_location(CA_NAME))
+        true
+      else
+        false
+      end
+    end
+  end
+  public :ensure_ca_certificate
+
+  # Creates an arry of SSL Certificate objects from a PEM-encoding string
+  # of one or more certs.
+  # @param [String] bundle_string PEM-encoded string of certs
+  # @return [[OpenSSL::X509::Certificate], nil] the certs loaded from the
+  #         input string, or nil if none could be loaded
+  def load_certificate_bundle(bundle_string)
+    delimiters = /-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----/m
+    certs = bundle_string.scan(delimiters)
+
+    if certs.empty?
+      raise Puppet::Error, _("No valid PEM-encoded certificates.")
+    end
+
+    certs.map do |cert|
+      begin
+        OpenSSL::X509::Certificate.new(cert)
+      rescue OpenSSL::X509::CertificateError => e
+        raise Puppet::Error, _("Could not parse certificate: %{message}") % { message: e.message }
+      end
+    end
+  end
+
+  # Fetches and saves the crl bundle from the CA server without validating
+  # its contents. Takes an optional store to use with the http_client,
+  # necessary for initial download of the CRL because `build_ssl_store`
+  # calls this `download_and_save_crl_bundle`. If there is an error during
+  # this downloading process, the file should not be replaced at all. This
+  # streams the file directly to disk to avoid loading the entire CRL in memory.
+  # @param [OpenSSL::X509::Store] store optional ssl_store to use with http_client
+  # @raise [Puppet::Error<Puppet::Rest::ResponseError>] if bad response from server
+  # @return nil
+  def download_and_save_crl_bundle(store=nil)
+    begin
+      # If no SSL store was supplied, use this host's SSL store
+      store ||= ssl_store
+      Puppet::Util.replace_file(crl_path, 0644) do |file|
+        result = Puppet::Rest::Routes.get_crls(CA_NAME, Puppet::Rest::SSLContext.new(OpenSSL::SSL::VERIFY_PEER, store))
+        file.write(result)
+      end
+    rescue Puppet::Rest::ResponseError => e
+      raise Puppet::Error, _('Could not download CRLs: %{message}') % { message: e.message }
+    end
+  end
+
+  # Fetches the CA certificate bundle from the CA server
+  # @raise [Puppet::Error] if response from the server is not a valid certificate
+  #                        bundle
+  # @return [[OpenSSL::X509::Certificate]] the certs loaded from the response
+  def download_ca_certificate_bundle
+    begin
+      cert_bundle = Puppet::Rest::Routes.get_certificate(
+        CA_NAME,
+        Puppet::Rest::SSLContext.new(OpenSSL::SSL::VERIFY_NONE)
+      )
+      # This load ensures that the response body is a valid cert bundle.
+      # If the text is malformed, load_certificate_bundle will raise.
+      begin
+        load_certificate_bundle(cert_bundle)
+      rescue Puppet::Error => e
+        raise Puppet::Error, _("Response from the CA did not contain a valid CA certificate: %{message}") % { message: e.message }
+      end
+    rescue Puppet::Rest::ResponseError => e
+      raise Puppet::Error, _('Could not download CA certificate: %{message}') % { message: e.message }
+    end
+  end
+
+  # Saves the given bundle to disk to a specified file path.
+  # @param bundle [[OpenSSL::X509::Certificate/CRL]] the certs to save
+  # @param location [String] place on disk to save bundle
+  def save_bundle(cert_bundle, location)
+    Puppet::Util.replace_file(location, 0644) do |f|
+      bundle_string = cert_bundle.map(&:to_pem).join("\n")
+      f.write(bundle_string)
+    end
+  end
+
+  # Attempts to load or fetch this host's certificate. Returns nil if
+  # no certificate could be found.
+  # @return [Puppet::SSL::Certificate, nil]
+  def get_host_certificate
+    if cert = check_for_certificate_on_disk(name)
+      return cert
+    elsif cert = download_certificate_from_ca(name)
+      save_host_certificate(cert)
+      return cert
+    else
+      return nil
+    end
+  end
 
-  def build_ssl_store(purpose)
+  # Checks for the requested certificate on disc, at a location
+  # determined by this host's configuration.
+  # @name [String] name the name of the cert to look for
+  # @raise [Puppet::Error] if contents of certificate file is invalid
+  #                        and could not be loaded
+  # @return [Puppet::SSL::Certificate, nil]
+  def check_for_certificate_on_disk(cert_name)
+    file_path = certificate_location(cert_name)
+    if Puppet::FileSystem.exist?(file_path)
+      begin
+        Puppet::SSL::Certificate.from_s(Puppet::FileSystem.read(file_path))
+      rescue OpenSSL::X509::CertificateError
+        raise Puppet::Error, _("The certificate at %{file_path} is invalid. Could not load.") % { file_path: file_path }
+      end
+    end
+  end
+  public :check_for_certificate_on_disk
+
+  # Attempts to download this host's certificate from the CA server.
+  # Returns nil if the CA does not yet have a signed cert for this host.
+  # @param [String] name then name of the cert to fetch
+  # @raise [Puppet::Error] if response from the CA does not contain a valid
+  #                        certificate
+  # @return [Puppet::SSL::Certificate, nil]
+  def download_certificate_from_ca(cert_name)
+    begin
+      cert = Puppet::Rest::Routes.get_certificate(
+        cert_name,
+        Puppet::Rest::SSLContext.new(OpenSSL::SSL::VERIFY_PEER, ssl_store)
+      )
+      begin
+        Puppet::SSL::Certificate.from_s(cert)
+      rescue OpenSSL::X509::CertificateError
+        raise Puppet::Error, _("Response from the CA did not contain a valid certificate for %{cert_name}.") % { cert_name: cert_name }
+      end
+    rescue Puppet::Rest::ResponseError => e
+      if e.response.code.to_i == 404
+        Puppet.debug _("No certificate for %{cert_name} on CA") % { cert_name: cert_name }
+        nil
+      else
+        raise Puppet::Rest::ResponseError, _("Could not download host certificate: %{message}") % { message: e.message }
+      end
+    end
+  end
+
+  # Returns the file path for the named certificate, based on this host's
+  # configuration.
+  # @param [String] name the name of the cert to find
+  # @return [String] file path to the cert's location
+  def certificate_location(cert_name)
+    cert_name == CA_NAME ? Puppet[:localcacert] : File.join(Puppet[:certdir], "#{cert_name}.pem")
+  end
+
+  # Returns the file path for the named CSR, based on this host's configuration.
+  # @param [String] name the name of the CSR to find
+  # @return [String] file path to the CSR's location
+  def certificate_request_location(cert_name)
+    File.join(Puppet[:requestdir], "#{cert_name}.pem")
+  end
+
+  # @param [OpenSSL::X509::PURPOSE_*] constant defining the kinds of certs
+  #   this store can verify
+  # @return [OpenSSL::X509::Store]
+  # @raise [OpenSSL::X509::StoreError] if localcacert is malformed or non-existant
+  # @raise [Puppet::Error] if the CRL chain is malformed
+  # @raise [Errno::ENOENT] if the CRL does not exist on disk but use_crl? is true
+  def build_ssl_store(purpose=OpenSSL::X509::PURPOSE_ANY)
     store = OpenSSL::X509::Store.new
     store.purpose = purpose
 
     # Use the file path here, because we don't want to cause
     # a lookup in the middle of setting our ssl connection.
-    store.add_file(Puppet[:localcacert])
-
-    # If we're doing revocation and there's a CRL, add it to our store.
-    if Puppet.lookup(:certificate_revocation)
-      if crl = Puppet::SSL::CertificateRevocationList.indirection.find(CA_NAME)
-        flags = OpenSSL::X509::V_FLAG_CRL_CHECK
-        if Puppet.lookup(:certificate_revocation) == :chain
-          flags |= OpenSSL::X509::V_FLAG_CRL_CHECK_ALL
-        end
-
-        store.flags = flags
-        store.add_crl(crl.content)
-      else
-        Puppet.debug _("Certificate revocation checking is enabled but a CRL cannot be found; CRL checking will not be performed.")
+    store.add_file(Puppet.settings[:localcacert])
+
+    if use_crl?
+      if !Puppet::FileSystem.exist?(crl_path)
+        download_and_save_crl_bundle(store)
       end
+
+      crls = load_crls(crl_path)
+
+      flags = OpenSSL::X509::V_FLAG_CRL_CHECK
+      if use_crl_chain?
+        flags |= OpenSSL::X509::V_FLAG_CRL_CHECK_ALL
+      end
+
+      store.flags = flags
+      crls.each {|crl| store.add_crl(crl) }
     end
     store
   end
 end
-
-require 'puppet/ssl/certificate_authority'