puppet 6.0.5-x64-mingw32 → 8.8.1-x64-mingw32

data/lib/puppet/ssl/base.rb

@@ -1,7 +1,8 @@
-require 'openssl'
-require 'puppet/ssl'
-require 'puppet/ssl/digest'
-require 'puppet/util/ssl'
+# frozen_string_literal: true
+
+require_relative '../../puppet/ssl/openssl_loader'
+require_relative '../../puppet/ssl'
+require_relative '../../puppet/ssl/digest'
 
 # The base class for wrapping SSL instances.
 class Puppet::SSL::Base
@@ -16,7 +17,7 @@ class Puppet::SSL::Base
   end
 
   def self.to_multiple_s(instances)
-    instances.collect { |inst| inst.to_s }.join(SEPARATOR)
+    instances.collect(&:to_s).join(SEPARATOR)
   end
 
   def self.wraps(klass)
@@ -25,6 +26,7 @@ class Puppet::SSL::Base
 
   def self.wrapped_class
     raise(Puppet::DevError, _("%{name} has not declared what class it wraps") % { name: self }) unless defined?(@wrapped_class)
+
     @wrapped_class
   end
 
@@ -54,14 +56,16 @@ class Puppet::SSL::Base
   #
   # @return [String] the name (CN) extracted from the subject.
   def self.name_from_subject(subject)
-    Puppet::Util::SSL.cn_from_subject(subject)
+    if subject.respond_to? :to_a
+      (subject.to_a.assoc('CN') || [])[1]
+    end
   end
 
   # Create an instance of our Puppet::SSL::* class using a given instance of the wrapped class
   def self.from_instance(instance, name = nil)
     unless instance.is_a?(wrapped_class)
       raise ArgumentError, _("Object must be an instance of %{class_name}, %{actual_class} given") %
-          { class_name: wrapped_class, actual_class: instance.class }
+                           { class_name: wrapped_class, actual_class: instance.class }
     end
     if name.nil? and !instance.respond_to?(:subject)
       raise ArgumentError, _("Name must be supplied if it cannot be determined from the instance")
@@ -82,21 +86,19 @@ class Puppet::SSL::Base
   # Read content from disk appropriately.
   def read(path)
     # applies to Puppet::SSL::Certificate, Puppet::SSL::CertificateRequest
-    # Puppet::SSL::Key uses this, but also provides its own override
     # nothing derives from Puppet::SSL::Certificate, but it is called by a number of other SSL Indirectors:
     # Puppet::Indirector::CertificateStatus::File (.indirection.find)
     # Puppet::Network::HTTP::WEBrick (.indirection.find)
     # Puppet::Network::HTTP::RackREST (.from_instance)
     # Puppet::Network::HTTP::WEBrickREST (.from_instance)
-    # Puppet::SSL::Host (.indirection.find)
     # Puppet::SSL::Inventory (.indirection.search, implements its own add / rebuild / serials with encoding UTF8)
-    # Puppet::SSL::Validator::DefaultValidator (.from_instance) / Puppet::SSL::Validator::NoValidator does nothing
     @content = wrapped_class.new(Puppet::FileSystem.read(path, :encoding => Encoding::ASCII))
   end
 
   # Convert our thing to pem.
   def to_s
     return "" unless content
+
     content.to_pem
   end
 
@@ -107,6 +109,7 @@ class Puppet::SSL::Base
   # Provide the full text of the thing we're dealing with.
   def to_text
     return "" unless content
+
     content.to_text
   end
 
@@ -115,10 +118,8 @@ class Puppet::SSL::Base
     digest(mds).to_hex
   end
 
-  def digest(algorithm=nil)
-    unless algorithm
-      algorithm = digest_algorithm
-    end
+  def digest(algorithm = nil)
+    algorithm ||= digest_algorithm
 
     Puppet::SSL::Digest.new(algorithm, content.to_der)
   end
@@ -135,7 +136,8 @@ class Puppet::SSL::Base
       /sha\d*/i
     )
     ln = content.signature_algorithm
-    if match = digest_re.match(ln)
+    match = digest_re.match(ln)
+    if match
       match[0].downcase
     else
       raise Puppet::Error, _("Unknown signature algorithm '%{ln}'") % { ln: ln }

data/lib/puppet/ssl/certificate.rb

@@ -1,20 +1,18 @@
-require 'puppet/ssl/base'
+# frozen_string_literal: true
+
+require_relative '../../puppet/ssl/base'
 
 # Manage certificates themselves.  This class has no
 # 'generate' method because the CA is responsible
 # for turning CSRs into certificates; we can only
 # retrieve them from the CA (or not, as is often
 # the case).
+#
+# @deprecated Use {Puppet::SSL::SSLProvider} instead.
 class Puppet::SSL::Certificate < Puppet::SSL::Base
   # This is defined from the base class
   wraps OpenSSL::X509::Certificate
 
-  extend Puppet::Indirector
-  indirects :certificate, :terminus_class => :file, :doc => <<DOC
-    This indirection wraps an `OpenSSL::X509::Certificate` object, representing a certificate (signed public key).
-    The indirection key is the certificate CN (generally a hostname).
-DOC
-
   # Because of how the format handler class is included, this
   # can't be in the base class.
   def self.supported_formats
@@ -22,8 +20,9 @@ DOC
   end
 
   def self.subject_alt_names_for(cert)
-    alts = cert.extensions.find{|ext| ext.oid == "subjectAltName"}
+    alts = cert.extensions.find { |ext| ext.oid == "subjectAltName" }
     return [] unless alts
+
     alts.value.split(/\s*,\s*/)
   end
 
@@ -33,13 +32,14 @@ DOC
 
   def expiration
     return nil unless content
+
     content.not_after
   end
 
   # This name is what gets extracted from the subject before being passed
   # to the constructor, so it's not downcased
   def unmunged_name
-    self.class.name_from_subject(content.subject)
+    self.class.name_from_subject(content.subject.to_utf8)
   end
 
   # Any extensions registered with custom OIDs as defined in module
@@ -54,17 +54,17 @@ DOC
   def custom_extensions
     custom_exts = content.extensions.select do |ext|
       Puppet::SSL::Oids.subtree_of?('ppRegCertExt', ext.oid) or
-        Puppet::SSL::Oids.subtree_of?('ppPrivCertExt', ext.oid)
+        Puppet::SSL::Oids.subtree_of?('ppPrivCertExt', ext.oid) or
+        Puppet::SSL::Oids.subtree_of?('ppAuthCertExt', ext.oid)
     end
 
     custom_exts.map do |ext|
-      {'oid' => ext.oid, 'value' => get_ext_val(ext.oid)}
+      { 'oid' => ext.oid, 'value' => get_ext_val(ext.oid) }
     end
   end
 
   private
 
-
   # Extract the extensions sequence from the wrapped certificate's raw ASN.1 form
   def exts_seq
     # See RFC-2459 section 4.1 (https://tools.ietf.org/html/rfc2459#section-4.1)
@@ -95,5 +95,4 @@ DOC
       raw_val
     end
   end
-
 end

data/lib/puppet/ssl/certificate_request.rb

@@ -1,5 +1,7 @@
-require 'puppet/ssl/base'
-require 'puppet/ssl/certificate_signer'
+# frozen_string_literal: true
+
+require_relative '../../puppet/ssl/base'
+require_relative '../../puppet/ssl/certificate_signer'
 
 # This class creates and manages X509 certificate signing requests.
 #
@@ -28,13 +30,6 @@ require 'puppet/ssl/certificate_signer'
 class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
   wraps OpenSSL::X509::Request
 
-  extend Puppet::Indirector
-
-  indirects :certificate_request, :terminus_class => :file, :doc => <<DOC
-    This indirection wraps an `OpenSSL::X509::Request` object, representing a certificate signing request (CSR).
-    The indirection key is the certificate CN (generally a hostname).
-DOC
-
   # Because of how the format handler class is included, this
   # can't be in the base class.
   def self.supported_formats
@@ -42,13 +37,14 @@ DOC
   end
 
   def extension_factory
+    # rubocop:disable Naming/MemoizedInstanceVariableName
     @ef ||= OpenSSL::X509::ExtensionFactory.new
+    # rubocop:enable Naming/MemoizedInstanceVariableName
   end
 
   # Create a certificate request with our system settings.
   #
-  # @param key [OpenSSL::X509::Key, Puppet::SSL::Key] The key pair associated
-  #   with this CSR.
+  # @param key [OpenSSL::X509::Key] The private key associated with this CSR.
   # @param options [Hash]
   # @option options [String] :dns_alt_names A comma separated list of
   #   Subject Alternative Names to include in the CSR extension request.
@@ -64,9 +60,6 @@ DOC
   def generate(key, options = {})
     Puppet.info _("Creating a new SSL certificate request for %{name}") % { name: name }
 
-    # Support either an actual SSL key, or a Puppet key.
-    key = key.content if key.is_a?(Puppet::SSL::Key)
-
     # If we're a CSR for the CA, then use the real ca_name, rather than the
     # fake 'ca' name.  This is mostly for backward compatibility with 0.24.x,
     # but it's also just a good idea.
@@ -75,7 +68,14 @@ DOC
     csr = OpenSSL::X509::Request.new
     csr.version = 0
     csr.subject = OpenSSL::X509::Name.new([["CN", common_name]])
-    csr.public_key = key.public_key
+
+    csr.public_key = if key.is_a?(OpenSSL::PKey::EC)
+                       # EC#public_key doesn't follow the PKey API,
+                       # see https://github.com/ruby/openssl/issues/29
+                       key
+                     else
+                       key.public_key
+                     end
 
     if options[:csr_attributes]
       add_csr_attributes(csr, options[:csr_attributes])
@@ -88,7 +88,7 @@ DOC
     signer = Puppet::SSL::CertificateSigner.new
     signer.sign(csr, key)
 
-    raise Puppet::Error, _("CSR sign verification failed; you need to clean the certificate request for %{name} on the server") % { name: name } unless csr.verify(key.public_key)
+    raise Puppet::Error, _("CSR sign verification failed; you need to clean the certificate request for %{name} on the server") % { name: name } unless csr.verify(csr.public_key)
 
     @content = csr
 
@@ -142,8 +142,8 @@ DOC
 
     # Prefer the standard extReq, but accept the Microsoft specific version as
     # a fallback, if the standard version isn't found.
-    attribute   = @content.attributes.find {|x| x.oid == "extReq" }
-    attribute ||= @content.attributes.find {|x| x.oid == "msExtReq" }
+    attribute   = @content.attributes.find { |x| x.oid == "extReq" }
+    attribute ||= @content.attributes.find { |x| x.oid == "msExtReq" }
     return [] unless attribute
 
     extensions = unpack_extension_request(attribute)
@@ -161,9 +161,9 @@ DOC
       # fixed component in the sequence.
       case ext_values.length
       when 2
-        {"oid" => ext_values[0].value, "value" => value}
+        { "oid" => ext_values[0].value, "value" => value }
       when 3
-        {"oid" => ext_values[0].value, "value" => value, "critical" => ext_values[1].value}
+        { "oid" => ext_values[0].value, "value" => value, "critical" => ext_values[1].value }
       else
         raise Puppet::Error, _("In %{attr}, expected extension record %{index} to have two or three items, but found %{count}") % { attr: attribute.oid, index: index, count: ext_values.length }
       end
@@ -171,12 +171,12 @@ DOC
   end
 
   def subject_alt_names
-    @subject_alt_names ||= request_extensions.
-      select {|x| x["oid"] == "subjectAltName" }.
-      map {|x| x["value"].split(/\s*,\s*/) }.
-      flatten.
-      sort.
-      uniq
+    @subject_alt_names ||= request_extensions
+                           .select { |x| x["oid"] == "subjectAltName" }
+                           .map { |x| x["value"].split(/\s*,\s*/) }
+                           .flatten
+                           .sort
+                           .uniq
   end
 
   # Return all user specified attributes attached to this CSR as a hash. IF an
@@ -196,7 +196,7 @@ DOC
     end
 
     x509_attributes.map do |attr|
-      {"oid" => attr.oid, "value" => attr.value.value.first.value}
+      { "oid" => attr.oid, "value" => attr.value.value.first.value }
     end
   end
 
@@ -209,29 +209,27 @@ DOC
   # we need to prevent that field from being written to directly.
   PRIVATE_CSR_ATTRIBUTES = [
     'extReq',   '1.2.840.113549.1.9.14',
-    'msExtReq', '1.3.6.1.4.1.311.2.1.14',
+    'msExtReq', '1.3.6.1.4.1.311.2.1.14'
   ]
 
   def add_csr_attributes(csr, csr_attributes)
     csr_attributes.each do |oid, value|
-      begin
-        if PRIVATE_CSR_ATTRIBUTES.include? oid
-          raise ArgumentError, _("Cannot specify CSR attribute %{oid}: conflicts with internally used CSR attribute") % { oid: oid }
-        end
+      if PRIVATE_CSR_ATTRIBUTES.include? oid
+        raise ArgumentError, _("Cannot specify CSR attribute %{oid}: conflicts with internally used CSR attribute") % { oid: oid }
+      end
 
-        encoded = OpenSSL::ASN1::PrintableString.new(value.to_s)
+      encoded = OpenSSL::ASN1::PrintableString.new(value.to_s)
 
-        attr_set = OpenSSL::ASN1::Set.new([encoded])
-        csr.add_attribute(OpenSSL::X509::Attribute.new(oid, attr_set))
-        Puppet.debug("Added csr attribute: #{oid} => #{attr_set.inspect}")
-      rescue OpenSSL::X509::AttributeError => e
-        raise Puppet::Error, _("Cannot create CSR with attribute %{oid}: %{message}") % { oid: oid, message: e.message }, e.backtrace
-      end
+      attr_set = OpenSSL::ASN1::Set.new([encoded])
+      csr.add_attribute(OpenSSL::X509::Attribute.new(oid, attr_set))
+      Puppet.debug("Added csr attribute: #{oid} => #{attr_set.inspect}")
+    rescue OpenSSL::X509::AttributeError => e
+      raise Puppet::Error, _("Cannot create CSR with attribute %{oid}: %{message}") % { oid: oid, message: e.message }, e.backtrace
     end
   end
 
   PRIVATE_EXTENSIONS = [
-    'subjectAltName', '2.5.29.17',
+    'subjectAltName', '2.5.29.17'
   ]
 
   # @api private
@@ -240,16 +238,14 @@ DOC
 
     if options[:extension_requests]
       options[:extension_requests].each_pair do |oid, value|
-        begin
-          if PRIVATE_EXTENSIONS.include? oid
-            raise Puppet::Error, _("Cannot specify CSR extension request %{oid}: conflicts with internally used extension request") % { oid: oid }
-          end
-
-          ext = OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(value.to_s).to_der, false)
-          extensions << ext
-        rescue OpenSSL::X509::ExtensionError => e
-          raise Puppet::Error, _("Cannot create CSR with extension request %{oid}: %{message}") % { oid: oid, message: e.message }, e.backtrace
+        if PRIVATE_EXTENSIONS.include? oid
+          raise Puppet::Error, _("Cannot specify CSR extension request %{oid}: conflicts with internally used extension request") % { oid: oid }
         end
+
+        ext = OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(value.to_s).to_der, false)
+        extensions << ext
+      rescue OpenSSL::X509::ExtensionError => e
+        raise Puppet::Error, _("Cannot create CSR with extension request %{oid}: %{message}") % { oid: oid, message: e.message }, e.backtrace
       end
     end
 
@@ -297,7 +293,6 @@ DOC
   # @return [Array<Array<Object>>] A array of arrays containing the extension
   #   OID the critical state if present, and the extension value.
   def unpack_extension_request(attribute)
-
     unless attribute.value.is_a? OpenSSL::ASN1::Set
       raise Puppet::Error, _("In %{attr}, expected Set but found %{klass}") % { attr: attribute.oid, klass: attribute.value.class }
     end

data/lib/puppet/ssl/certificate_request_attributes.rb

@@ -1,12 +1,13 @@
-require 'puppet/ssl'
-require 'puppet/util/yaml'
+# frozen_string_literal: true
+
+require_relative '../../puppet/ssl'
+require_relative '../../puppet/util/yaml'
 
 # This class transforms simple key/value pairs into the equivalent ASN1
 # structures. Values may be strings or arrays of strings.
 #
 # @api private
 class Puppet::SSL::CertificateRequestAttributes
-
   attr_reader :path, :custom_attributes, :extension_requests
 
   def initialize(path)
@@ -22,16 +23,18 @@ class Puppet::SSL::CertificateRequestAttributes
     Puppet.info(_("csr_attributes file loading from %{path}") % { path: path })
     if Puppet::FileSystem.exist?(path)
       hash = Puppet::Util::Yaml.safe_load_file(path, [Symbol]) || {}
-      if ! hash.is_a?(Hash)
+      unless hash.is_a?(Hash)
         raise Puppet::Error, _("invalid CSR attributes, expected instance of Hash, received instance of %{klass}") % { klass: hash.class }
       end
+
       @custom_attributes = hash.delete('custom_attributes') || {}
       @extension_requests = hash.delete('extension_requests') || {}
-      if not hash.keys.empty?
+      unless hash.keys.empty?
         raise Puppet::Error, _("unexpected attributes %{keys} in %{path}") % { keys: hash.keys.inspect, path: @path.inspect }
       end
+
       return true
     end
-    return false
+    false
   end
 end

data/lib/puppet/ssl/certificate_signer.rb

@@ -1,10 +1,11 @@
+# frozen_string_literal: true
+
 # Take care of signing a certificate in a FIPS 140-2 compliant manner.
 #
 # @see https://projects.puppetlabs.com/issues/17295
 #
 # @api private
 class Puppet::SSL::CertificateSigner
-
   # @!attribute [r] digest
   #   @return [OpenSSL::Digest]
   attr_reader :digest
@@ -22,11 +23,16 @@ class Puppet::SSL::CertificateSigner
       @digest = OpenSSL::Digest::SHA224
     else
       raise Puppet::Error,
-        "No FIPS 140-2 compliant digest algorithm in OpenSSL::Digest"
+            "No FIPS 140-2 compliant digest algorithm in OpenSSL::Digest"
     end
-    @digest
   end
 
+  # Sign a certificate signing request (CSR) with a private key.
+  #
+  # @param [OpenSSL::X509::Request] content The CSR to sign
+  # @param [OpenSSL::X509::PKey] key The private key to sign with
+  #
+  # @api private
   def sign(content, key)
     content.sign(key, @digest.new)
   end

data/lib/puppet/ssl/digest.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class Puppet::SSL::Digest
   attr_reader :digest
 

data/lib/puppet/ssl/error.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Puppet::SSL
+  class SSLError < Puppet::Error; end
+
+  class CertVerifyError < Puppet::SSL::SSLError
+    attr_reader :code, :cert
+
+    def initialize(message, code, cert)
+      super(message)
+      @code = code
+      @cert = cert
+    end
+  end
+
+  class CertMismatchError < Puppet::SSL::SSLError
+    def initialize(peer_cert, host)
+      valid_certnames = [peer_cert.subject.to_utf8.sub(/.*=/, ''),
+                         *Puppet::SSL::Certificate.subject_alt_names_for(peer_cert)].uniq
+      if valid_certnames.size > 1
+        expected_certnames = _("expected one of %{certnames}") % { certnames: valid_certnames.join(', ') }
+      else
+        expected_certnames = _("expected %{certname}") % { certname: valid_certnames.first }
+      end
+
+      super(_("Server hostname '%{host}' did not match server certificate; %{expected_certnames}") % { host: host, expected_certnames: expected_certnames })
+    end
+  end
+end

data/lib/puppet/ssl/oids.rb

@@ -1,11 +1,14 @@
-require 'puppet/ssl'
+# frozen_string_literal: true
+
+require_relative '../../puppet/ssl'
 
 # This module defines OIDs for use within Puppet.
 #
-# == ASN.1 Definition
+# # ASN.1 Definition
 #
 # The following is the formal definition of OIDs specified in this file.
 #
+# ```
 # puppetCertExtensions OBJECT IDENTIFIER ::= {iso(1) identified-organization(3)
 #    dod(6) internet(1) private(4) enterprise(1) 34380 1}
 #
@@ -22,10 +25,10 @@ require 'puppet/ssl'
 # pp_instance_id OBJECT IDENTIFIER ::= { registeredExtensions 2 }
 # pp_image_name OBJECT IDENTIFIER ::= { registeredExtensions 3 }
 # pp_preshared_key OBJECT IDENTIFIER ::= { registeredExtensions 4 }
+# ```
 #
 # @api private
 module Puppet::SSL::Oids
-
   # Note: When updating the following OIDs make sure to also update the OID
   # definitions here:
   # https://github.com/puppetlabs/puppetserver/blob/master/src/clj/puppetlabs/puppetserver/certificate_authority.clj#L122-L159
@@ -61,13 +64,16 @@ module Puppet::SSL::Oids
     ["1.3.6.1.4.1.34380.1.1.23", 'pp_cloudplatform', 'Puppet Node Cloud Platform Name'],
     ["1.3.6.1.4.1.34380.1.1.24", 'pp_apptier', 'Puppet Node Application Tier'],
     ["1.3.6.1.4.1.34380.1.1.25", 'pp_hostname', 'Puppet Node Hostname'],
+    ["1.3.6.1.4.1.34380.1.1.26", 'pp_owner', 'Puppet Node Owner'],
 
     ["1.3.6.1.4.1.34380.1.2", 'ppPrivCertExt', 'Puppet Private Certificate Extension'],
 
     ["1.3.6.1.4.1.34380.1.3", 'ppAuthCertExt', 'Puppet Certificate Authorization Extension'],
 
-    ["1.3.6.1.4.1.34380.1.3.1",  'pp_authorization', 'Certificate Extension Authorization'],
+    ["1.3.6.1.4.1.34380.1.3.1", 'pp_authorization', 'Certificate Extension Authorization'],
+    ["1.3.6.1.4.1.34380.1.3.2", 'pp_auth_auto_renew', 'Auto-Renew Certificate Attribute'],
     ["1.3.6.1.4.1.34380.1.3.13", 'pp_auth_role', 'Puppet Node Role Name for Authorization'],
+    ["1.3.6.1.4.1.34380.1.3.39", 'pp_cli_auth', 'Puppetserver CA CLI Authorization']
   ]
 
   @did_register_puppet_oids = false
@@ -75,8 +81,8 @@ module Puppet::SSL::Oids
   # Register our custom Puppet OIDs with OpenSSL so they can be used as CSR
   # extensions. Without registering these OIDs, OpenSSL will fail when it
   # encounters such an extension in a CSR.
-  def self.register_puppet_oids()
-    if !@did_register_puppet_oids
+  def self.register_puppet_oids
+    unless @did_register_puppet_oids
       PUPPET_OIDS.each do |oid_defn|
         OpenSSL::ASN1::ObjectId.register(*oid_defn)
       end
@@ -100,8 +106,8 @@ module Puppet::SSL::Oids
   #  '1.3.6.1.4.1.34380.1.2.1.2':
   #    shortname: 'myothershortname'
   #    longname: 'Other Long name'
-  def self.parse_custom_oid_file(custom_oid_file, map_key='oid_mapping')
-    if File.exists?(custom_oid_file) && File.readable?(custom_oid_file)
+  def self.parse_custom_oid_file(custom_oid_file, map_key = 'oid_mapping')
+    if File.exist?(custom_oid_file) && File.readable?(custom_oid_file)
       mapping = nil
       begin
         mapping = Puppet::Util::Yaml.safe_load_file(custom_oid_file, [Symbol])
@@ -119,10 +125,11 @@ module Puppet::SSL::Oids
 
       oid_defns = []
       mapping[map_key].keys.each do |oid|
-        shortname, longname = mapping[map_key][oid].values_at("shortname","longname")
+        shortname, longname = mapping[map_key][oid].values_at("shortname", "longname")
         if shortname.nil? || longname.nil?
           raise Puppet::Error, _("Error loading ssl custom OIDs mapping file from '%{custom_oid_file}': incomplete definition of oid '%{oid}'") % { custom_oid_file: custom_oid_file, oid: oid }
         end
+
         oid_defns << [oid, shortname, longname]
       end
 
@@ -145,7 +152,7 @@ module Puppet::SSL::Oids
   #  '1.3.6.1.4.1.34380.1.2.1.2':
   #    shortname: 'myothershortname'
   #    longname: 'Other Long name'
-  def self.load_custom_oid_file(custom_oid_file, map_key='oid_mapping')
+  def self.load_custom_oid_file(custom_oid_file, map_key = 'oid_mapping')
     oid_defns = parse_custom_oid_file(custom_oid_file, map_key)
     unless oid_defns.nil?
       begin
@@ -181,7 +188,6 @@ module Puppet::SSL::Oids
     first_oid = OpenSSL::ASN1::ObjectId.new(first).oid
     second_oid = OpenSSL::ASN1::ObjectId.new(second).oid
 
-
     if exclusive and first_oid == second_oid
       false
     else

data/lib/puppet/ssl/openssl_loader.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/util/platform'
+
+# This file should be required instead of writing `require 'openssl'`
+# or any library that loads openssl like `net/https`. This allows the
+# core Puppet code to load correctly in JRuby environments that do not
+# have a functioning openssl (eg a FIPS enabled one).
+
+if Puppet::Util::Platform.jruby_fips?
+  # Even in JRuby we need to define the constants that are wrapped in
+  # Indirections: Puppet::SSL::{Key, Certificate, CertificateRequest}
+  module OpenSSL
+    module PKey
+      class RSA; end
+    end
+
+    module X509
+      class Request; end
+      class Certificate; end
+    end
+  end
+else
+  require 'openssl'
+  require 'net/https'
+end

data/lib/puppet/ssl/ssl_context.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require_relative '../../puppet/ssl'
+
+module Puppet::SSL
+  # The `keyword_init: true` option is no longer needed in Ruby >= 3.2
+  SSLContext = Struct.new(
+    :store,
+    :cacerts,
+    :crls,
+    :private_key,
+    :client_cert,
+    :client_chain,
+    :revocation,
+    :verify_peer,
+    keyword_init: true
+  ) do
+    def initialize(*)
+      super
+      self[:cacerts] ||= []
+      self[:crls] ||= []
+      self[:client_chain] ||= []
+      self[:revocation] = true if self[:revocation].nil?
+      self[:verify_peer] = true if self[:verify_peer].nil?
+    end
+  end
+end