puppet 6.14.0-x64-mingw32 → 6.19.0-x64-mingw32

data/spec/unit/ssl/oids_spec.rb

@@ -33,6 +33,7 @@ describe Puppet::SSL::Oids do
       'pp_cloudplatform'    => '1.3.6.1.4.1.34380.1.1.23',
       'pp_apptier'          => '1.3.6.1.4.1.34380.1.1.24',
       'pp_hostname'         => '1.3.6.1.4.1.34380.1.1.25',
+      'pp_owner'            => '1.3.6.1.4.1.34380.1.1.26',
       'ppPrivCertExt'       => '1.3.6.1.4.1.34380.1.2',
       'ppAuthCertExt'       => '1.3.6.1.4.1.34380.1.3',
       'pp_authorization'    => '1.3.6.1.4.1.34380.1.3.1',

data/spec/unit/ssl/ssl_provider_spec.rb

@@ -42,20 +42,20 @@ describe Puppet::SSL::SSLProvider do
     let(:config) { { cacerts: [], crls: [], revocation: false } }
 
     it 'accepts empty list of certs and crls' do
-      sslctx = subject.create_root_context(config)
+      sslctx = subject.create_root_context(**config)
       expect(sslctx.cacerts).to eq([])
       expect(sslctx.crls).to eq([])
     end
 
     it 'accepts valid root certs' do
       certs = [cert_fixture('ca.pem')]
-      sslctx = subject.create_root_context(config.merge(cacerts: certs))
+      sslctx = subject.create_root_context(**config.merge(cacerts: certs))
       expect(sslctx.cacerts).to eq(certs)
     end
 
     it 'accepts valid intermediate certs' do
       certs = [cert_fixture('ca.pem'), cert_fixture('intermediate.pem')]
-      sslctx = subject.create_root_context(config.merge(cacerts: certs))
+      sslctx = subject.create_root_context(**config.merge(cacerts: certs))
       expect(sslctx.cacerts).to eq(certs)
     end
 
@@ -63,19 +63,19 @@ describe Puppet::SSL::SSLProvider do
       expired = [cert_fixture('ca.pem'), cert_fixture('intermediate.pem')]
       expired.each { |x509| x509.not_after = Time.at(0) }
 
-      sslctx = subject.create_root_context(config.merge(cacerts: expired))
+      sslctx = subject.create_root_context(**config.merge(cacerts: expired))
       expect(sslctx.cacerts).to eq(expired)
     end
 
     it 'raises if the frozen context is modified' do
-      sslctx = subject.create_root_context(config)
+      sslctx = subject.create_root_context(**config)
       expect {
         sslctx.verify_peer = false
       }.to raise_error(/can't modify frozen/)
     end
 
     it 'verifies peer' do
-      sslctx = subject.create_root_context(config)
+      sslctx = subject.create_root_context(**config)
       expect(sslctx.verify_peer).to eq(true)
     end
   end
@@ -134,6 +134,32 @@ describe Puppet::SSL::SSLProvider do
       expect(sslctx.client_cert).to be_nil
       expect(sslctx.private_key).to be_nil
     end
+
+    it 'trusts additional system certs' do
+      path = tmpfile('system_cacerts')
+      File.write(path, cert_fixture('ca.pem').to_pem)
+
+      expect_any_instance_of(OpenSSL::X509::Store).to receive(:add_file).with(path)
+
+      subject.create_system_context(cacerts: [], path: path)
+    end
+
+    it 'ignores empty files' do
+      path = tmpfile('system_cacerts')
+      FileUtils.touch(path)
+
+      subject.create_system_context(cacerts: [], path: path)
+
+      expect(@logs).to eq([])
+    end
+
+    it 'prints an error if it is not a file' do
+      path = tmpdir('system_cacerts')
+
+      subject.create_system_context(cacerts: [], path: path)
+
+      expect(@logs).to include(an_object_having_attributes(level: :warning, message: /^The 'ssl_trust_store' setting does not refer to a file and will be ignored/))
+    end
   end
 
   context 'when creating an ssl context with crls' do
@@ -142,14 +168,14 @@ describe Puppet::SSL::SSLProvider do
     it 'accepts valid CRLs' do
       certs = [cert_fixture('ca.pem')]
       crls = [crl_fixture('crl.pem')]
-      sslctx = subject.create_root_context(config.merge(cacerts: certs, crls: crls))
+      sslctx = subject.create_root_context(**config.merge(cacerts: certs, crls: crls))
       expect(sslctx.crls).to eq(crls)
     end
 
     it 'accepts valid CRLs for intermediate certs' do
       certs = [cert_fixture('ca.pem'), cert_fixture('intermediate.pem')]
       crls = [crl_fixture('crl.pem'), crl_fixture('intermediate-crl.pem')]
-      sslctx = subject.create_root_context(config.merge(cacerts: certs, crls: crls))
+      sslctx = subject.create_root_context(**config.merge(cacerts: certs, crls: crls))
       expect(sslctx.crls).to eq(crls)
     end
 
@@ -157,12 +183,12 @@ describe Puppet::SSL::SSLProvider do
       expired = [crl_fixture('crl.pem'), crl_fixture('intermediate-crl.pem')]
       expired.each { |x509| x509.last_update = Time.at(0) }
 
-      sslctx = subject.create_root_context(config.merge(crls: expired))
+      sslctx = subject.create_root_context(**config.merge(crls: expired))
       expect(sslctx.crls).to eq(expired)
     end
 
     it 'verifies peer' do
-      sslctx = subject.create_root_context(config)
+      sslctx = subject.create_root_context(**config)
       expect(sslctx.verify_peer).to eq(true)
     end
   end
@@ -174,49 +200,49 @@ describe Puppet::SSL::SSLProvider do
 
     it 'raises if CA certs are missing' do
       expect {
-        subject.create_context(config.merge(cacerts: nil))
+        subject.create_context(**config.merge(cacerts: nil))
       }.to raise_error(ArgumentError, /CA certs are missing/)
     end
 
     it 'raises if CRLs are are missing' do
       expect {
-        subject.create_context(config.merge(crls: nil))
+        subject.create_context(**config.merge(crls: nil))
       }.to raise_error(ArgumentError, /CRLs are missing/)
     end
 
     it 'raises if private key is missing' do
       expect {
-        subject.create_context(config.merge(private_key: nil))
+        subject.create_context(**config.merge(private_key: nil))
       }.to raise_error(ArgumentError, /Private key is missing/)
     end
 
     it 'raises if client cert is missing' do
       expect {
-        subject.create_context(config.merge(client_cert: nil))
+        subject.create_context(**config.merge(client_cert: nil))
       }.to raise_error(ArgumentError, /Client cert is missing/)
     end
 
     it 'accepts RSA keys' do
-      sslctx = subject.create_context(config)
+      sslctx = subject.create_context(**config)
       expect(sslctx.private_key).to eq(private_key)
     end
 
     it 'accepts EC keys' do
       ec_key = ec_key_fixture('ec-key.pem')
       ec_cert = cert_fixture('ec.pem')
-      sslctx = subject.create_context(config.merge(client_cert: ec_cert, private_key: ec_key))
+      sslctx = subject.create_context(**config.merge(client_cert: ec_cert, private_key: ec_key))
       expect(sslctx.private_key).to eq(ec_key)
     end
 
     it 'raises if private key is unsupported' do
       dsa_key = OpenSSL::PKey::DSA.new
       expect {
-        subject.create_context(config.merge(private_key: dsa_key))
+        subject.create_context(**config.merge(private_key: dsa_key))
       }.to raise_error(Puppet::SSL::SSLError, /Unsupported key 'OpenSSL::PKey::DSA'/)
     end
 
     it 'resolves the client chain from leaf to root' do
-      sslctx = subject.create_context(config)
+      sslctx = subject.create_context(**config)
       expect(
         sslctx.client_chain.map(&:subject).map(&:to_utf8)
       ).to eq(['CN=signed', 'CN=Test CA Subauthority', 'CN=Test CA'])
@@ -225,21 +251,21 @@ describe Puppet::SSL::SSLProvider do
     it 'raises if client cert signature is invalid' do
       client_cert.sign(wrong_key, OpenSSL::Digest::SHA256.new)
       expect {
-        subject.create_context(config.merge(client_cert: client_cert))
+        subject.create_context(**config.merge(client_cert: client_cert))
       }.to raise_error(Puppet::SSL::CertVerifyError,
                        "Invalid signature for certificate 'CN=signed'")
     end
 
     it 'raises if client cert and private key are mismatched' do
       expect {
-        subject.create_context(config.merge(private_key: wrong_key))
+        subject.create_context(**config.merge(private_key: wrong_key))
       }.to raise_error(Puppet::SSL::SSLError,
                        "The certificate for 'CN=signed' does not match its private key")
     end
 
     it "raises if client cert's public key has been replaced" do
       expect {
-        subject.create_context(config.merge(client_cert: cert_fixture('tampered-cert.pem')))
+        subject.create_context(**config.merge(client_cert: cert_fixture('tampered-cert.pem')))
       }.to raise_error(Puppet::SSL::CertVerifyError,
                        "Invalid signature for certificate 'CN=signed'")
     end
@@ -250,7 +276,7 @@ describe Puppet::SSL::SSLProvider do
       ca.sign(wrong_key, OpenSSL::Digest::SHA256.new)
 
       expect {
-        subject.create_context(config.merge(cacerts: global_cacerts))
+        subject.create_context(**config.merge(cacerts: global_cacerts))
       }.to raise_error(Puppet::SSL::CertVerifyError,
                        "Invalid signature for certificate 'CN=Test CA'")
     end
@@ -260,7 +286,7 @@ describe Puppet::SSL::SSLProvider do
       int.sign(wrong_key, OpenSSL::Digest::SHA256.new)
 
       expect {
-        subject.create_context(config.merge(cacerts: global_cacerts))
+        subject.create_context(**config.merge(cacerts: global_cacerts))
       }.to raise_error(Puppet::SSL::CertVerifyError,
                        "Invalid signature for certificate 'CN=Test CA Subauthority'")
     end
@@ -270,7 +296,7 @@ describe Puppet::SSL::SSLProvider do
       crl.sign(wrong_key, OpenSSL::Digest::SHA256.new)
 
       expect {
-        subject.create_context(config.merge(crls: global_crls))
+        subject.create_context(**config.merge(crls: global_crls))
       }.to raise_error(Puppet::SSL::CertVerifyError,
                        "Invalid signature for CRL issued by 'CN=Test CA'")
     end
@@ -280,14 +306,14 @@ describe Puppet::SSL::SSLProvider do
       crl.sign(wrong_key, OpenSSL::Digest::SHA256.new)
 
       expect {
-        subject.create_context(config.merge(crls: global_crls))
+        subject.create_context(**config.merge(crls: global_crls))
       }.to raise_error(Puppet::SSL::CertVerifyError,
                        "Invalid signature for CRL issued by 'CN=Test CA Subauthority'")
     end
 
     it 'raises if client cert is revoked' do
       expect {
-        subject.create_context(config.merge(private_key: key_fixture('revoked-key.pem'), client_cert: cert_fixture('revoked.pem')))
+        subject.create_context(**config.merge(private_key: key_fixture('revoked-key.pem'), client_cert: cert_fixture('revoked.pem')))
       }.to raise_error(Puppet::SSL::CertVerifyError,
                        "Certificate 'CN=revoked' is revoked")
     end
@@ -295,12 +321,12 @@ describe Puppet::SSL::SSLProvider do
     it 'warns if intermediate issuer is missing' do
       expect(Puppet).to receive(:warning).with("The issuer 'CN=Test CA Subauthority' of certificate 'CN=signed' cannot be found locally")
 
-      subject.create_context(config.merge(cacerts: [cert_fixture('ca.pem')]))
+      subject.create_context(**config.merge(cacerts: [cert_fixture('ca.pem')]))
     end
 
     it 'raises if root issuer is missing' do
       expect {
-        subject.create_context(config.merge(cacerts: [cert_fixture('intermediate.pem')]))
+        subject.create_context(**config.merge(cacerts: [cert_fixture('intermediate.pem')]))
       }.to raise_error(Puppet::SSL::CertVerifyError,
                        "The issuer 'CN=Test CA' of certificate 'CN=Test CA Subauthority' is missing")
     end
@@ -308,7 +334,7 @@ describe Puppet::SSL::SSLProvider do
     it 'raises if cert is not valid yet', unless: Puppet::Util::Platform.jruby? do
       client_cert.not_before = Time.now + (5 * 60 * 60)
       expect {
-        subject.create_context(config.merge(client_cert: client_cert))
+        subject.create_context(**config.merge(client_cert: client_cert))
       }.to raise_error(Puppet::SSL::CertVerifyError,
                        "The certificate 'CN=signed' is not yet valid, verify time is synchronized")
     end
@@ -316,7 +342,7 @@ describe Puppet::SSL::SSLProvider do
     it 'raises if cert is expired', unless: Puppet::Util::Platform.jruby? do
       client_cert.not_after = Time.at(0)
       expect {
-        subject.create_context(config.merge(client_cert: client_cert))
+        subject.create_context(**config.merge(client_cert: client_cert))
       }.to raise_error(Puppet::SSL::CertVerifyError,
                        "The certificate 'CN=signed' has expired, verify time is synchronized")
     end
@@ -327,7 +353,7 @@ describe Puppet::SSL::SSLProvider do
       future_crls.first.last_update = Time.now + (5 * 60 * 60)
 
       expect {
-        subject.create_context(config.merge(crls: future_crls))
+        subject.create_context(**config.merge(crls: future_crls))
       }.to raise_error(Puppet::SSL::CertVerifyError,
                        "The CRL issued by 'CN=Test CA' is not yet valid, verify time is synchronized")
     end
@@ -338,7 +364,7 @@ describe Puppet::SSL::SSLProvider do
       past_crls.first.next_update = Time.at(0)
 
       expect {
-        subject.create_context(config.merge(crls: past_crls))
+        subject.create_context(**config.merge(crls: past_crls))
       }.to raise_error(Puppet::SSL::CertVerifyError,
                        "The CRL issued by 'CN=Test CA' has expired, verify time is synchronized")
     end
@@ -346,7 +372,7 @@ describe Puppet::SSL::SSLProvider do
     it 'raises if the root CRL is missing' do
       crls = [crl_fixture('intermediate-crl.pem')]
       expect {
-        subject.create_context(config.merge(crls: crls, revocation: :chain))
+        subject.create_context(**config.merge(crls: crls, revocation: :chain))
       }.to raise_error(Puppet::SSL::CertVerifyError,
                        "The CRL issued by 'CN=Test CA' is missing")
     end
@@ -354,23 +380,23 @@ describe Puppet::SSL::SSLProvider do
     it 'raises if the intermediate CRL is missing' do
       crls = [crl_fixture('crl.pem')]
       expect {
-        subject.create_context(config.merge(crls: crls))
+        subject.create_context(**config.merge(crls: crls))
       }.to raise_error(Puppet::SSL::CertVerifyError,
                        "The CRL issued by 'CN=Test CA Subauthority' is missing")
     end
 
     it "doesn't raise if the root CRL is missing and we're just checking the leaf" do
       crls = [crl_fixture('intermediate-crl.pem')]
-      subject.create_context(config.merge(crls: crls, revocation: :leaf))
+      subject.create_context(**config.merge(crls: crls, revocation: :leaf))
     end
 
     it "doesn't raise if the intermediate CRL is missing and revocation checking is disabled" do
       crls = [crl_fixture('crl.pem')]
-      subject.create_context(config.merge(crls: crls, revocation: false))
+      subject.create_context(**config.merge(crls: crls, revocation: false))
     end
 
     it "doesn't raise if both CRLs are missing and revocation checking is disabled" do
-      subject.create_context(config.merge(crls: [], revocation: false))
+      subject.create_context(**config.merge(crls: [], revocation: false))
     end
 
     # OpenSSL < 1.1 does not verify basicConstraints
@@ -378,7 +404,7 @@ describe Puppet::SSL::SSLProvider do
       certs = [cert_fixture('bad-basic-constraints.pem'), cert_fixture('intermediate.pem')]
 
       expect {
-        subject.create_context(config.merge(cacerts: certs, crls: [], revocation: false))
+        subject.create_context(**config.merge(cacerts: certs, crls: [], revocation: false))
       }.to raise_error(Puppet::SSL::CertVerifyError,
                        "Certificate 'CN=Test CA' failed verification (24): invalid CA certificate")
     end
@@ -388,32 +414,32 @@ describe Puppet::SSL::SSLProvider do
       certs = [cert_fixture('ca.pem'), cert_fixture('bad-int-basic-constraints.pem')]
 
       expect {
-        subject.create_context(config.merge(cacerts: certs, crls: [], revocation: false))
+        subject.create_context(**config.merge(cacerts: certs, crls: [], revocation: false))
       }.to raise_error(Puppet::SSL::CertVerifyError,
                        "Certificate 'CN=Test CA Subauthority' failed verification (24): invalid CA certificate")
     end
 
     it 'accepts CA certs in any order' do
-      sslctx = subject.create_context(config.merge(cacerts: global_cacerts.reverse))
+      sslctx = subject.create_context(**config.merge(cacerts: global_cacerts.reverse))
       # certs in ruby+openssl 1.0.x are not comparable, so compare subjects
       expect(sslctx.client_chain.map(&:subject).map(&:to_utf8)).to contain_exactly('CN=Test CA', 'CN=Test CA Subauthority', 'CN=signed')
     end
 
     it 'accepts CRLs in any order' do
-      sslctx = subject.create_context(config.merge(crls: global_crls.reverse))
+      sslctx = subject.create_context(**config.merge(crls: global_crls.reverse))
       # certs in ruby+openssl 1.0.x are not comparable, so compare subjects
       expect(sslctx.client_chain.map(&:subject).map(&:to_utf8)).to contain_exactly('CN=Test CA', 'CN=Test CA Subauthority', 'CN=signed')
     end
 
     it 'raises if the frozen context is modified' do
-      sslctx = subject.create_context(config)
+      sslctx = subject.create_context(**config)
       expect {
         sslctx.verify_peer = false
       }.to raise_error(/can't modify frozen/)
     end
 
     it 'verifies peer' do
-      sslctx = subject.create_context(config)
+      sslctx = subject.create_context(**config)
       expect(sslctx.verify_peer).to eq(true)
     end
   end

data/spec/unit/ssl/state_machine_spec.rb

@@ -197,7 +197,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
   end
 
   context 'when locking' do
-    let(:lockfile) { double('ssllockfile') }
+    let(:lockfile) { Puppet::Util::Pidlock.new(Puppet[:ssl_lockfile]) }
     let(:machine) { described_class.new(cert_provider: cert_provider, ssl_provider: ssl_provider, lockfile: lockfile) }
 
     # lockfile is deleted before `ensure_ca_certificates` returns, so
@@ -210,7 +210,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
     end
 
     it 'locks the file prior to running the state machine and unlocks when done' do
-      expect(lockfile).to receive(:lock).and_return(true).ordered
+      expect(lockfile).to receive(:lock).and_call_original.ordered
       expect(cert_provider).to receive(:load_cacerts).and_return(cacerts).ordered
       expect(cert_provider).to receive(:load_crls).and_return(crls).ordered
       expect(lockfile).to receive(:unlock).ordered
@@ -228,13 +228,6 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       expect(File).to_not be_exist(Puppet[:ssl_lockfile])
     end
 
-    it 'raises an exception when locking fails' do
-      allow(lockfile).to receive(:lock).and_return(false)
-      expect {
-        machine.ensure_ca_certificates
-      }.to raise_error(Puppet::Error, /Another puppet instance is already running; exiting/)
-    end
-
     it 'acquires an empty lockfile' do
       Puppet::FileSystem.touch(Puppet[:ssl_lockfile])
 
@@ -262,6 +255,57 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       machine = described_class.new(cert_provider: cert_provider, ssl_provider: ssl_provider)
       machine.ensure_ca_certificates
     end
+
+    context 'and another puppet process is running' do
+      let(:now) { Time.now }
+      let(:future) { now + (5 * 60)} # 5 mins in the future
+
+      before :each do
+        allow(lockfile).to receive(:lock).and_return(false)
+      end
+
+      it 'raises a puppet exception' do
+        expect {
+          machine.ensure_ca_certificates
+        }.to raise_error(Puppet::Error, /Another puppet instance is already running and the waitforlock setting is set to 0; exiting/)
+      end
+
+      it 'sleeps and retries successfully' do
+        machine = described_class.new(lockfile: lockfile, cert_provider: cert_provider, waitforlock: 1, maxwaitforlock: 10)
+        allow(cert_provider).to receive(:load_cacerts).and_return(cacerts)
+        allow(cert_provider).to receive(:load_crls).and_return(crls)
+        allow(Time).to receive(:now).and_return(now, future)
+
+        expect(Kernel).to receive(:sleep).with(1)
+        expect(Puppet).to receive(:info).with("Another puppet instance is already running; waiting for it to finish")
+        expect(Puppet).to receive(:info).with("Will try again in 1 seconds.")
+
+        allow(lockfile).to receive(:lock).and_return(false, true)
+
+        expect(machine.ensure_ca_certificates).to be_an_instance_of(Puppet::SSL::SSLContext)
+      end
+
+      it 'sleeps and retries unsuccessfully until the deadline is exceeded' do
+        machine = described_class.new(lockfile: lockfile, waitforlock: 1, maxwaitforlock: 10)
+        allow(Time).to receive(:now).and_return(now, future)
+
+        expect(Kernel).to receive(:sleep).with(1)
+        expect(Puppet).to receive(:info).with("Another puppet instance is already running; waiting for it to finish")
+        expect(Puppet).to receive(:info).with("Will try again in 1 seconds.")
+
+        allow(lockfile).to receive(:lock).and_return(false)
+        expect {
+          machine.ensure_ca_certificates
+        }.to raise_error(Puppet::Error, /Another puppet instance is already running and the maxwaitforlock timeout has been exceeded; exiting/)
+      end
+
+      it 'defaults the waitlock deadline to 60 seconds' do
+        allow(Time).to receive(:now).and_return(now)
+
+        machine = described_class.new
+        expect(machine.waitlock_deadline).to eq(now.to_i + 60)
+      end
+    end
   end
 
   context 'NeedCACerts' do
@@ -837,7 +881,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
         }.to output(/Exiting now because the waitforcert setting is set to 0./).to_stdout
       end
 
-      it 'sleeps and transitions to NeedCACerts' do
+      it 'sleeps and transitions to NeedLock' do
         machine = described_class.new(waitforcert: 15)
 
         state = Puppet::SSL::StateMachine::Wait.new(machine)
@@ -845,10 +889,10 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
 
         expect(Puppet).to receive(:info).with(/Will try again in 15 seconds./)
 
-        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedCACerts)
+        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedLock)
       end
 
-      it 'sleeps and transitions to NeedCACerts when maxwaitforcert is set' do
+      it 'sleeps and transitions to NeedLock when maxwaitforcert is set' do
         machine = described_class.new(waitforcert: 15, maxwaitforcert: 30)
 
         state = Puppet::SSL::StateMachine::Wait.new(machine)
@@ -856,7 +900,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
 
         expect(Puppet).to receive(:info).with(/Will try again in 15 seconds./)
 
-        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedCACerts)
+        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedLock)
       end
 
       it 'waits indefinitely by default' do
@@ -882,11 +926,43 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
         machine = described_class.new(waitforcert: 15)
 
         state = Puppet::SSL::StateMachine::Wait.new(machine)
-        expect(Puppet.runtime['http'].pool).to receive(:close).and_call_original
+        expect(Puppet.runtime[:http].pool).to receive(:close).and_call_original
         expect(Kernel).to receive(:sleep).with(15).ordered
 
         state.next_state
       end
+
+      it 'releases the lock while sleeping' do
+        lockfile = Puppet::Util::Pidlock.new(Puppet[:ssl_lockfile])
+        machine = described_class.new(lockfile: lockfile)
+        state = Puppet::SSL::StateMachine::Wait.new(machine)
+
+        # pidlock should be unlocked while sleeping
+        allow(Kernel).to receive(:sleep) do
+          expect(lockfile).to_not be_locked
+        end
+
+        # lock before running the state
+        lockfile.lock
+        state.next_state
+      end
+    end
+
+    context 'in state NeedLock' do
+      let(:ssl_context) { Puppet::SSL::SSLContext.new(cacerts: []) }
+      let(:lockfile) { Puppet::Util::Pidlock.new(Puppet[:ssl_lockfile]) }
+      let(:machine) { described_class.new(lockfile: lockfile) }
+      let(:state) { Puppet::SSL::StateMachine::NeedLock.new(machine) }
+
+      it 'acquires the lock and transitions to NeedCACerts' do
+        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedCACerts)
+        expect(lockfile).to be_locked
+      end
+
+      it 'transitions to LockFailure if it fails to acquire the lock' do
+        expect(lockfile).to receive(:lock).and_return(false)
+        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::LockFailure)
+      end
     end
   end
 end