puppet 6.4.0-universal-darwin → 6.4.1-universal-darwin

data/spec/unit/ssl/key_spec.rb

@@ -1,4 +1,3 @@
-#! /usr/bin/env ruby
 require 'spec_helper'
 
 require 'puppet/ssl/key'
@@ -48,36 +47,36 @@ describe Puppet::SSL::Key do
 
     it "should be able to read keys from disk" do
       path = "/my/path"
-      Puppet::FileSystem.expects(:read).with(path, :encoding => Encoding::ASCII).returns("my key")
-      key = mock 'key'
-      OpenSSL::PKey::RSA.expects(:new).returns(key)
+      expect(Puppet::FileSystem).to receive(:read).with(path, :encoding => Encoding::ASCII).and_return("my key")
+      key = double('key')
+      expect(OpenSSL::PKey::RSA).to receive(:new).and_return(key)
       expect(@key.read(path)).to equal(key)
       expect(@key.content).to equal(key)
     end
 
     it "should not try to use the provided password file if the file does not exist" do
-      Puppet::FileSystem.stubs(:exist?).returns false
+      allow(Puppet::FileSystem).to receive(:exist?).and_return(false)
       @key.password_file = "/path/to/password"
 
       path = "/my/path"
 
-      Puppet::FileSystem.stubs(:read).with(path, :encoding => Encoding::ASCII).returns("my key")
-      OpenSSL::PKey::RSA.expects(:new).with("my key", nil).returns(mock('key'))
-      Puppet::FileSystem.expects(:read).with("/path/to/password", :encoding => Encoding::BINARY).never
+      allow(Puppet::FileSystem).to receive(:read).with(path, :encoding => Encoding::ASCII).and_return("my key")
+      expect(OpenSSL::PKey::RSA).to receive(:new).with("my key", nil).and_return(double('key'))
+      expect(Puppet::FileSystem).not_to receive(:read).with("/path/to/password", :encoding => Encoding::BINARY)
 
       @key.read(path)
     end
 
     it "should read the key with the password retrieved from the password file if one is provided" do
-      Puppet::FileSystem.stubs(:exist?).returns true
+      allow(Puppet::FileSystem).to receive(:exist?).and_return(true)
       @key.password_file = "/path/to/password"
 
       path = "/my/path"
-      Puppet::FileSystem.expects(:read).with(path, :encoding => Encoding::ASCII).returns("my key")
-      Puppet::FileSystem.expects(:read).with("/path/to/password", :encoding => Encoding::BINARY).returns("my password")
+      expect(Puppet::FileSystem).to receive(:read).with(path, :encoding => Encoding::ASCII).and_return("my key")
+      expect(Puppet::FileSystem).to receive(:read).with("/path/to/password", :encoding => Encoding::BINARY).and_return("my password")
 
-      key = mock 'key'
-      OpenSSL::PKey::RSA.expects(:new).with("my key", "my password").returns(key)
+      key = double('key')
+      expect(OpenSSL::PKey::RSA).to receive(:new).with("my key", "my password").and_return(key)
       expect(@key.read(path)).to equal(key)
       expect(@key.content).to equal(key)
     end
@@ -87,14 +86,14 @@ describe Puppet::SSL::Key do
     end
 
     it "should convert the key to pem format when converted to a string" do
-      key = mock 'key', :to_pem => "pem"
+      key = double('key', :to_pem => "pem")
       @key.content = key
       expect(@key.to_s).to eq("pem")
     end
 
     it "should have a :to_text method that it delegates to the actual key" do
-      real_key = mock 'key'
-      real_key.expects(:to_text).returns "keytext"
+      real_key = double('key')
+      expect(real_key).to receive(:to_text).and_return("keytext")
       @key.content = real_key
       expect(@key.to_text).to eq("keytext")
     end
@@ -104,43 +103,43 @@ describe Puppet::SSL::Key do
     before do
       @instance = @class.new("test")
 
-      @key = mock 'key'
+      @key = double('key')
     end
 
     it "should create an instance of OpenSSL::PKey::RSA" do
-      OpenSSL::PKey::RSA.expects(:new).returns(@key)
+      expect(OpenSSL::PKey::RSA).to receive(:new).and_return(@key)
 
       @instance.generate
     end
 
     it "should create the private key with the keylength specified in the settings" do
       Puppet[:keylength] = 513
-      OpenSSL::PKey::RSA.expects(:new).with(513).returns(@key)
+      expect(OpenSSL::PKey::RSA).to receive(:new).with(513).and_return(@key)
 
       @instance.generate
     end
 
     it "should set the content to the generated key" do
-      OpenSSL::PKey::RSA.stubs(:new).returns(@key)
+      allow(OpenSSL::PKey::RSA).to receive(:new).and_return(@key)
       @instance.generate
       expect(@instance.content).to equal(@key)
     end
 
     it "should return the generated key" do
-      OpenSSL::PKey::RSA.stubs(:new).returns(@key)
+      allow(OpenSSL::PKey::RSA).to receive(:new).and_return(@key)
       expect(@instance.generate).to equal(@key)
     end
 
     it "should return the key in pem format" do
       @instance.generate
-      @instance.content.expects(:to_pem).returns "my normal key"
+      expect(@instance.content).to receive(:to_pem).and_return("my normal key")
       expect(@instance.to_s).to eq("my normal key")
     end
 
     describe "with a password file set" do
       it "should return a nil password if the password file does not exist" do
-        Puppet::FileSystem.expects(:exist?).with("/path/to/pass").returns false
-        Puppet::FileSystem.expects(:read).with("/path/to/pass", :encoding => Encoding::BINARY).never
+        expect(Puppet::FileSystem).to receive(:exist?).with("/path/to/pass").and_return(false)
+        expect(Puppet::FileSystem).not_to receive(:read).with("/path/to/pass", :encoding => Encoding::BINARY)
 
         @instance.password_file = "/path/to/pass"
 
@@ -148,8 +147,8 @@ describe Puppet::SSL::Key do
       end
 
       it "should return the contents of the password file as its password" do
-        Puppet::FileSystem.expects(:exist?).with("/path/to/pass").returns true
-        Puppet::FileSystem.expects(:read).with("/path/to/pass", :encoding => Encoding::BINARY).returns "my password"
+        expect(Puppet::FileSystem).to receive(:exist?).with("/path/to/pass").and_return(true)
+        expect(Puppet::FileSystem).to receive(:read).with("/path/to/pass", :encoding => Encoding::BINARY).and_return("my password")
 
         @instance.password_file = "/path/to/pass"
 
@@ -158,14 +157,14 @@ describe Puppet::SSL::Key do
 
       it "should export the private key to text using the password" do
         @instance.password_file = "/path/to/pass"
-        @instance.stubs(:password).returns "my password"
+        allow(@instance).to receive(:password).and_return("my password")
 
-        OpenSSL::PKey::RSA.expects(:new).returns(@key)
+        expect(OpenSSL::PKey::RSA).to receive(:new).and_return(@key)
         @instance.generate
 
-        cipher = mock 'cipher'
-        OpenSSL::Cipher::DES.expects(:new).with(:EDE3, :CBC).returns cipher
-        @key.expects(:export).with(cipher, "my password").returns "my encrypted key"
+        cipher = double('cipher')
+        expect(OpenSSL::Cipher::DES).to receive(:new).with(:EDE3, :CBC).and_return(cipher)
+        expect(@key).to receive(:export).with(cipher, "my password").and_return("my encrypted key")
 
         expect(@instance.to_s).to eq("my encrypted key")
       end

data/spec/unit/ssl/ssl_provider_spec.rb

@@ -151,8 +151,8 @@ describe Puppet::SSL::SSLProvider do
     it 'resolves the client chain from leaf to root' do
       sslctx = subject.create_context(config)
       expect(
-        sslctx.client_chain.map(&:subject).map(&:to_s)
-      ).to eq(['/CN=signed', '/CN=Test CA Subauthority', '/CN=Test CA'])
+        sslctx.client_chain.map(&:subject).map(&:to_utf8)
+      ).to eq(['CN=signed', 'CN=Test CA Subauthority', 'CN=Test CA'])
     end
 
     it 'raises if client cert signature is invalid' do
@@ -160,21 +160,21 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.create_context(config.merge(client_cert: client_cert))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "Invalid signature for certificate '/CN=signed'")
+                       "Invalid signature for certificate 'CN=signed'")
     end
 
     it 'raises if client cert and private key are mismatched' do
       expect {
         subject.create_context(config.merge(private_key: wrong_key))
       }.to raise_error(Puppet::SSL::SSLError,
-                       "The certificate for '/CN=signed' does not match its private key")
+                       "The certificate for 'CN=signed' does not match its private key")
     end
 
     it "raises if client cert's public key has been replaced" do
       expect {
         subject.create_context(config.merge(client_cert: cert_fixture('tampered-cert.pem')))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "Invalid signature for certificate '/CN=signed'")
+                       "Invalid signature for certificate 'CN=signed'")
     end
 
     # This option is only available in openssl 1.1
@@ -185,7 +185,7 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.create_context(config.merge(cacerts: global_cacerts))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "Invalid signature for certificate '/CN=Test CA'")
+                       "Invalid signature for certificate 'CN=Test CA'")
     end
 
     it 'raises if intermediate CA signature is invalid' do
@@ -195,7 +195,7 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.create_context(config.merge(cacerts: global_cacerts))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "Invalid signature for certificate '/CN=Test CA Subauthority'")
+                       "Invalid signature for certificate 'CN=Test CA Subauthority'")
     end
 
     it 'raises if CRL signature for root CA is invalid', unless: Puppet::Util::Platform.jruby? do
@@ -205,7 +205,7 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.create_context(config.merge(crls: global_crls))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "Invalid signature for CRL issued by '/CN=Test CA'")
+                       "Invalid signature for CRL issued by 'CN=Test CA'")
     end
 
     it 'raises if CRL signature for intermediate CA is invalid', unless: Puppet::Util::Platform.jruby? do
@@ -215,18 +215,18 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.create_context(config.merge(crls: global_crls))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "Invalid signature for CRL issued by '/CN=Test CA Subauthority'")
+                       "Invalid signature for CRL issued by 'CN=Test CA Subauthority'")
     end
 
     it 'raises if client cert is revoked' do
       expect {
         subject.create_context(config.merge(private_key: key_fixture('revoked-key.pem'), client_cert: cert_fixture('revoked.pem')))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "Certificate '/CN=revoked' is revoked")
+                       "Certificate 'CN=revoked' is revoked")
     end
 
     it 'warns if intermediate issuer is missing' do
-      Puppet.expects(:warning).with("The issuer '/CN=Test CA Subauthority' of certificate '/CN=signed' cannot be found locally")
+      expect(Puppet).to receive(:warning).with("The issuer 'CN=Test CA Subauthority' of certificate 'CN=signed' cannot be found locally")
 
       subject.create_context(config.merge(cacerts: [cert_fixture('ca.pem')]))
     end
@@ -235,7 +235,7 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.create_context(config.merge(cacerts: [cert_fixture('intermediate.pem')]))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "The issuer '/CN=Test CA' of certificate '/CN=Test CA Subauthority' is missing")
+                       "The issuer 'CN=Test CA' of certificate 'CN=Test CA Subauthority' is missing")
     end
 
     it 'raises if cert is not valid yet', unless: Puppet::Util::Platform.jruby? do
@@ -243,7 +243,7 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.create_context(config.merge(client_cert: client_cert))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "The certificate '/CN=signed' is not yet valid, verify time is synchronized")
+                       "The certificate 'CN=signed' is not yet valid, verify time is synchronized")
     end
 
     it 'raises if cert is expired', unless: Puppet::Util::Platform.jruby? do
@@ -251,7 +251,7 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.create_context(config.merge(client_cert: client_cert))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "The certificate '/CN=signed' has expired, verify time is synchronized")
+                       "The certificate 'CN=signed' has expired, verify time is synchronized")
     end
 
     it 'raises if crl is not valid yet', unless: Puppet::Util::Platform.jruby? do
@@ -262,7 +262,7 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.create_context(config.merge(crls: future_crls))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "The CRL issued by '/CN=Test CA' is not yet valid, verify time is synchronized")
+                       "The CRL issued by 'CN=Test CA' is not yet valid, verify time is synchronized")
     end
 
     it 'raises if crl is expired', unless: Puppet::Util::Platform.jruby? do
@@ -273,7 +273,7 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.create_context(config.merge(crls: past_crls))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "The CRL issued by '/CN=Test CA' has expired, verify time is synchronized")
+                       "The CRL issued by 'CN=Test CA' has expired, verify time is synchronized")
     end
 
     it 'raises if the root CRL is missing' do
@@ -281,7 +281,7 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.create_context(config.merge(crls: crls, revocation: :chain))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "The CRL issued by '/CN=Test CA' is missing")
+                       "The CRL issued by 'CN=Test CA' is missing")
     end
 
     it 'raises if the intermediate CRL is missing' do
@@ -289,7 +289,7 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.create_context(config.merge(crls: crls))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "The CRL issued by '/CN=Test CA Subauthority' is missing")
+                       "The CRL issued by 'CN=Test CA Subauthority' is missing")
     end
 
     it "doesn't raise if the root CRL is missing and we're just checking the leaf" do
@@ -313,7 +313,7 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.create_context(config.merge(cacerts: certs, crls: [], revocation: false))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "Certificate '/CN=Test CA' failed verification (24): invalid CA certificate")
+                       "Certificate 'CN=Test CA' failed verification (24): invalid CA certificate")
     end
 
     # OpenSSL < 1.1 does not verify basicConstraints
@@ -323,19 +323,19 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.create_context(config.merge(cacerts: certs, crls: [], revocation: false))
       }.to raise_error(Puppet::SSL::CertVerifyError,
-                       "Certificate '/CN=Test CA Subauthority' failed verification (24): invalid CA certificate")
+                       "Certificate 'CN=Test CA Subauthority' failed verification (24): invalid CA certificate")
     end
 
     it 'accepts CA certs in any order' do
       sslctx = subject.create_context(config.merge(cacerts: global_cacerts.reverse))
       # certs in ruby+openssl 1.0.x are not comparable, so compare subjects
-      expect(sslctx.client_chain.map(&:subject).map(&:to_s)).to contain_exactly('/CN=Test CA', '/CN=Test CA Subauthority', '/CN=signed')
+      expect(sslctx.client_chain.map(&:subject).map(&:to_utf8)).to contain_exactly('CN=Test CA', 'CN=Test CA Subauthority', 'CN=signed')
     end
 
     it 'accepts CRLs in any order' do
       sslctx = subject.create_context(config.merge(crls: global_crls.reverse))
       # certs in ruby+openssl 1.0.x are not comparable, so compare subjects
-      expect(sslctx.client_chain.map(&:subject).map(&:to_s)).to contain_exactly('/CN=Test CA', '/CN=Test CA Subauthority', '/CN=signed')
+      expect(sslctx.client_chain.map(&:subject).map(&:to_utf8)).to contain_exactly('CN=Test CA', 'CN=Test CA Subauthority', 'CN=signed')
     end
 
     it 'raises if the frozen context is modified' do
@@ -414,7 +414,7 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.verify_request(csr, wrong_key.public_key)
       }.to raise_error(Puppet::SSL::SSLError,
-                       "The CSR for host '/CN=pending' does not match the public key")
+                       "The CSR for host 'CN=pending' does not match the public key")
     end
 
     it "raises if the CSR was tampered with" do
@@ -422,7 +422,7 @@ describe Puppet::SSL::SSLProvider do
       expect {
         subject.verify_request(csr, csr.public_key)
       }.to raise_error(Puppet::SSL::SSLError,
-                       "The CSR for host '/CN=signed' does not match the public key")
+                       "The CSR for host 'CN=signed' does not match the public key")
     end
   end
 end

data/spec/unit/ssl/state_machine_spec.rb

@@ -10,8 +10,8 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
   before(:each) do
     WebMock.disable_net_connect!
 
-    Net::HTTP.any_instance.stubs(:start)
-    Net::HTTP.any_instance.stubs(:finish)
+    allow_any_instance_of(Net::HTTP).to receive(:start)
+    allow_any_instance_of(Net::HTTP).to receive(:finish)
   end
 
   let(:machine) { described_class.new }
@@ -29,14 +29,14 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
   before(:each) do
     WebMock.disable_net_connect!
 
-    Net::HTTP.any_instance.stubs(:start)
-    Net::HTTP.any_instance.stubs(:finish)
+    allow_any_instance_of(Net::HTTP).to receive(:start)
+    allow_any_instance_of(Net::HTTP).to receive(:finish)
   end
 
   context 'when ensuring CA certs and CRLs' do
     it 'returns an SSLContext with the loaded CA certs and CRLs' do
-      Puppet::X509::CertProvider.any_instance.stubs(:load_cacerts).returns(cacerts)
-      Puppet::X509::CertProvider.any_instance.stubs(:load_crls).returns(crls)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_cacerts).and_return(cacerts)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_crls).and_return(crls)
 
       ssl_context = machine.ensure_ca_certificates
 
@@ -48,10 +48,10 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
 
   context 'when ensuring a client cert' do
     it 'returns an SSLContext with the loaded CA certs, CRLs, private key and client cert' do
-      Puppet::X509::CertProvider.any_instance.stubs(:load_cacerts).returns(cacerts)
-      Puppet::X509::CertProvider.any_instance.stubs(:load_crls).returns(crls)
-      Puppet::X509::CertProvider.any_instance.stubs(:load_private_key).returns(private_key)
-      Puppet::X509::CertProvider.any_instance.stubs(:load_client_cert).returns(client_cert)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_cacerts).and_return(cacerts)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_crls).and_return(crls)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_private_key).and_return(private_key)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_client_cert).and_return(client_cert)
 
       ssl_context = machine.ensure_client_certificate
 
@@ -71,20 +71,20 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
     end
 
     it 'transitions to NeedCRLs state' do
-      Puppet::X509::CertProvider.any_instance.stubs(:load_cacerts).returns(cacerts)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_cacerts).and_return(cacerts)
 
       expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedCRLs)
     end
 
     it 'loads existing CA certs' do
-      Puppet::X509::CertProvider.any_instance.stubs(:load_cacerts).returns(cacerts)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_cacerts).and_return(cacerts)
 
       st = state.next_state
       expect(st.ssl_context[:cacerts]).to eq(cacerts)
     end
 
     it 'fetches and saves CA certs' do
-      Puppet::X509::CertProvider.any_instance.stubs(:load_cacerts).returns(nil)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_cacerts).and_return(nil)
       stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: cacert_pem)
 
       st = state.next_state
@@ -93,11 +93,11 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
     end
 
     it "does not verify the server's cert if there are no local CA certs" do
-      Puppet::X509::CertProvider.any_instance.stubs(:load_cacerts).returns(nil)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_cacerts).and_return(nil)
       stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: cacert_pem)
-      Puppet::X509::CertProvider.any_instance.stubs(:save_cacerts)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:save_cacerts)
 
-      Net::HTTP.any_instance.expects(:verify_mode=).with(OpenSSL::SSL::VERIFY_NONE)
+      expect_any_instance_of(Net::HTTP).to receive(:verify_mode=).with(OpenSSL::SSL::VERIFY_NONE)
 
       state.next_state
     end
@@ -119,7 +119,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
     end
 
     it 'raises if CA certs are invalid' do
-      Puppet::X509::CertProvider.any_instance.stubs(:load_cacerts).returns(nil)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_cacerts).and_return(nil)
       stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: '')
 
       expect {
@@ -148,20 +148,20 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
     end
 
     it 'transitions to NeedKey state' do
-      Puppet::X509::CertProvider.any_instance.stubs(:load_crls).returns(crls)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_crls).and_return(crls)
 
       expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedKey)
     end
 
     it 'loads existing CRLs' do
-      Puppet::X509::CertProvider.any_instance.stubs(:load_crls).returns(crls)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_crls).and_return(crls)
 
       st = state.next_state
       expect(st.ssl_context[:crls]).to eq(crls)
     end
 
     it 'fetches and saves CRLs' do
-      Puppet::X509::CertProvider.any_instance.stubs(:load_crls).returns(nil)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_crls).and_return(nil)
       stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_pem)
 
       st = state.next_state
@@ -170,11 +170,11 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
     end
 
     it "verifies the server's certificate when fetching the CRL" do
-      Puppet::X509::CertProvider.any_instance.stubs(:load_crls).returns(nil)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_crls).and_return(nil)
       stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: crl_pem)
-      Puppet::X509::CertProvider.any_instance.stubs(:save_crls)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:save_crls)
 
-      Net::HTTP.any_instance.expects(:verify_mode=).with(OpenSSL::SSL::VERIFY_PEER)
+      expect_any_instance_of(Net::HTTP).to receive(:verify_mode=).with(OpenSSL::SSL::VERIFY_PEER)
 
       state.next_state
     end
@@ -196,7 +196,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
     end
 
     it 'raises if CRLs are invalid' do
-      Puppet::X509::CertProvider.any_instance.stubs(:load_crls).returns(nil)
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_crls).and_return(nil)
       stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: '')
 
       expect {
@@ -218,8 +218,8 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
     it 'skips CRL download when revocation is disabled' do
       Puppet[:certificate_revocation] = false
 
-      Puppet::X509::CertProvider.any_instance.expects(:load_crls).never
-      Puppet::Rest::Routes.expects(:get_crls).never
+      expect_any_instance_of(Puppet::X509::CertProvider).not_to receive(:load_crls)
+      expect(Puppet::Rest::Routes).not_to receive(:get_crls)
 
       state.next_state
 
@@ -233,7 +233,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       let(:state) { Puppet::SSL::StateMachine::NeedKey.new(machine, ssl_context) }
 
       it 'loads an existing private key and passes it to the next state' do
-        Puppet::X509::CertProvider.any_instance.stubs(:load_private_key).returns(private_key)
+        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_private_key).and_return(private_key)
 
         st = state.next_state
         expect(st).to be_instance_of(Puppet::SSL::StateMachine::NeedSubmitCSR)
@@ -241,25 +241,25 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       end
 
       it 'loads a matching private key and cert' do
-        Puppet::X509::CertProvider.any_instance.stubs(:load_private_key).returns(private_key)
-        Puppet::X509::CertProvider.any_instance.stubs(:load_client_cert).returns(client_cert)
+        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_private_key).and_return(private_key)
+        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_client_cert).and_return(client_cert)
 
         st = state.next_state
         expect(st).to be_instance_of(Puppet::SSL::StateMachine::Done)
       end
 
       it 'raises if the client cert is mismatched' do
-        Puppet::X509::CertProvider.any_instance.stubs(:load_private_key).returns(private_key)
-        Puppet::X509::CertProvider.any_instance.stubs(:load_client_cert).returns(cert_fixture('tampered-cert.pem'))
+        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_private_key).and_return(private_key)
+        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_client_cert).and_return(cert_fixture('tampered-cert.pem'))
 
         expect {
           state.next_state
-        }.to raise_error(Puppet::SSL::SSLError, %r{The certificate for '/CN=signed' does not match its private key})
+        }.to raise_error(Puppet::SSL::SSLError, %r{The certificate for 'CN=signed' does not match its private key})
       end
 
       it 'generates a new private key, saves it and passes it to the next state' do
-        Puppet::X509::CertProvider.any_instance.stubs(:load_private_key).returns(nil)
-        Puppet::X509::CertProvider.any_instance.expects(:save_private_key)
+        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_private_key).and_return(nil)
+        expect_any_instance_of(Puppet::X509::CertProvider).to receive(:save_private_key)
 
         st = state.next_state
         expect(st).to be_instance_of(Puppet::SSL::StateMachine::NeedSubmitCSR)
@@ -267,7 +267,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       end
 
       it 'raises an error if it fails to load the key' do
-        Puppet::X509::CertProvider.any_instance.stubs(:load_private_key).raises(OpenSSL::PKey::RSAError)
+        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_private_key).and_raise(OpenSSL::PKey::RSAError)
 
         expect {
           state.next_state
@@ -286,7 +286,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       end
 
       before :each do
-        Puppet::X509::CertProvider.any_instance.stubs(:save_request)
+        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:save_request)
       end
 
       it 'submits the CSR and transitions to NeedCert' do
@@ -298,7 +298,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       it 'saves the CSR and transitions to NeedCert' do
         stub_request(:put, %r{puppet-ca/v1/certificate_request/#{Puppet[:certname]}}).to_return(status: 200)
 
-        Puppet::X509::CertProvider.any_instance.expects(:save_request).with(Puppet[:certname], instance_of(OpenSSL::X509::Request))
+        expect_any_instance_of(Puppet::X509::CertProvider).to receive(:save_request).with(Puppet[:certname], instance_of(OpenSSL::X509::Request))
 
         state.next_state
       end
@@ -389,7 +389,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       it "verifies the server's certificate when submitting the CSR" do
         stub_request(:put, %r{puppet-ca/v1/certificate_request/#{Puppet[:certname]}}).to_return(status: 200)
 
-        Net::HTTP.any_instance.expects(:verify_mode=).with(OpenSSL::SSL::VERIFY_PEER)
+        expect_any_instance_of(Net::HTTP).to receive(:verify_mode=).with(OpenSSL::SSL::VERIFY_PEER)
 
         state.next_state
       end
@@ -402,8 +402,8 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       let(:state) { Puppet::SSL::StateMachine::NeedCert.new(machine, ssl_context, private_key) }
 
       it 'transitions to Done if the cert is signed and matches our private key' do
-        Puppet::X509::CertProvider.any_instance.stubs(:save_client_cert)
-        Puppet::X509::CertProvider.any_instance.stubs(:save_request)
+        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:save_client_cert)
+        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:save_request)
 
         stub_request(:get, %r{puppet-ca/v1/certificate/#{Puppet[:certname]}}).to_return(status: 200, body: client_cert.to_pem)
 
@@ -425,10 +425,10 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
 
       it "verifies the server's certificate when getting the client cert" do
         stub_request(:get, %r{puppet-ca/v1/certificate/#{Puppet[:certname]}}).to_return(status: 200, body: client_cert.to_pem)
-        Puppet::X509::CertProvider.any_instance.stubs(:save_client_cert)
-        Puppet::X509::CertProvider.any_instance.stubs(:save_request)
+        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:save_client_cert)
+        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:save_request)
 
-        Net::HTTP.any_instance.expects(:verify_mode=).with(OpenSSL::SSL::VERIFY_PEER)
+        expect_any_instance_of(Net::HTTP).to receive(:verify_mode=).with(OpenSSL::SSL::VERIFY_PEER)
 
         state.next_state
       end
@@ -451,7 +451,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
 
         state.next_state
 
-        expect(@logs).to include(an_object_having_attributes(message: %r{The certificate for '/CN=127.0.0.1' does not match its private key}))
+        expect(@logs).to include(an_object_having_attributes(message: %r{The certificate for 'CN=127.0.0.1' does not match its private key}))
         expect(File).to_not exist(Puppet[:hostcert])
       end
 
@@ -461,7 +461,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
 
         state.next_state
 
-        expect(@logs).to include(an_object_having_attributes(message: %r{Certificate '/CN=revoked' is revoked}))
+        expect(@logs).to include(an_object_having_attributes(message: %r{Certificate 'CN=revoked' is revoked}))
         expect(File).to_not exist(Puppet[:hostcert])
       end
     end
@@ -469,31 +469,23 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
     context 'in state Wait' do
       let(:ssl_context) { Puppet::SSL::SSLContext.new(cacerts: cacerts, crls: crls)}
 
-      it 'exits with 1 if only running once' do
-        machine = described_class.new(onetime: true)
-
-        expect {
-          expect {
-            Puppet::SSL::StateMachine::Wait.new(machine, ssl_context).next_state
-          }.to output("Exiting; no certificate found and waitforcert is disabled").to_stdout
-        }.to exit_with(1)
-      end
-
       it 'exits with 1 if waitforcert is 0' do
         machine = described_class.new(waitforcert: 0)
 
         expect {
           expect {
             Puppet::SSL::StateMachine::Wait.new(machine, ssl_context).next_state
-          }.to output("Exiting; no certificate found and waitforcert is disabled").to_stdout
-        }.to exit_with(1)
+          }.to exit_with(1)
+        }.to output(/Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate \(.*\). Exiting now because the waitforcert setting is set to 0./).to_stdout
       end
 
       it 'sleeps and transitions to NeedCACerts' do
         machine = described_class.new(waitforcert: 15)
 
         state = Puppet::SSL::StateMachine::Wait.new(machine, ssl_context)
-        state.expects(:sleep).with(15)
+        expect(state).to receive(:sleep).with(15)
+
+        expect(Puppet).to receive(:info).with(/Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate \(.*\). Will try again in 15 seconds./)
 
         expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedCACerts)
       end