puppet 6.4.5-universal-darwin → 6.5.0-universal-darwin

data/spec/unit/resource_spec.rb

@@ -747,8 +747,7 @@ describe Puppet::Resource do
       @resource = Puppet::Resource.new("one::two", "/my/file",
         :parameters => {
           :noop => true,
-          :foo => [:one, "two"],
-          :bar => 'a\'b',
+          :foo => %w{one two},
           :ensure => 'present',
         }
       )
@@ -758,34 +757,10 @@ describe Puppet::Resource do
       expect(@resource.to_hierayaml).to eq(<<-HEREDOC.gsub(/^\s{8}/, ''))
           /my/file:
             ensure: 'present'
-            bar   : 'a\\'b'
             foo   : ['one', 'two']
             noop  : true
       HEREDOC
     end
-
-    it "should convert some types to String" do
-      expect(@resource.to_hiera_hash).to eq(
-        "/my/file" => {
-          'ensure' => "present",
-          'bar'    => "a'b",
-          'foo'    => ["one", "two"],
-          'noop'   => true
-        }
-      )
-    end
-
-    it "accepts symbolic titles" do
-      res = Puppet::Resource.new(:file, "/my/file", :parameters => { 'ensure' => "present" })
-
-      expect(res.to_hiera_hash.keys).to eq(["/my/file"])
-    end
-
-    it "emits an empty parameters hash" do
-      res = Puppet::Resource.new(:file, "/my/file")
-
-      expect(res.to_hiera_hash).to eq({"/my/file" => {}})
-    end
   end
 
   describe "when converting to json" do

data/spec/unit/ssl/host_spec.rb

@@ -1,4 +1,5 @@
 require 'spec_helper'
+require 'webmock/rspec'
 require 'puppet/test_ca'
 
 require 'puppet/ssl/host'
@@ -307,6 +308,10 @@ describe Puppet::SSL::Host, if: !Puppet::Util::Platform.jruby? do
       allow(@host).to receive(:validate_certificate_with_key)
       allow(@host).to receive(:http_client).and_return(@http)
       allow(@host).to receive(:ssl_store).and_return(double("ssl store"))
+
+      WebMock.disable_net_connect!
+      allow_any_instance_of(Net::HTTP).to receive(:start)
+      allow_any_instance_of(Net::HTTP).to receive(:finish)
     end
 
     let(:ca_cert_response) { @pki[:ca_bundle] }

data/spec/unit/ssl/ssl_provider_spec.rb

@@ -7,12 +7,6 @@ describe Puppet::SSL::SSLProvider do
   let(:global_crls) { [ crl_fixture('crl.pem'), crl_fixture('intermediate-crl.pem') ] }
   let(:wrong_key) { OpenSSL::PKey::RSA.new(512) }
 
-  def as_pem_file(x509)
-    path = tmpfile('ssl_provider_pem')
-    File.write(path, x509.to_pem)
-    path
-  end
-
   context 'when creating an insecure context' do
     let(:sslctx) { subject.create_insecure_context }
 
@@ -141,11 +135,18 @@ describe Puppet::SSL::SSLProvider do
       expect(sslctx.private_key).to eq(private_key)
     end
 
+    it 'accepts EC keys' do
+      ec_key = ec_key_fixture('ec-key.pem')
+      ec_cert = cert_fixture('ec.pem')
+      sslctx = subject.create_context(config.merge(client_cert: ec_cert, private_key: ec_key))
+      expect(sslctx.private_key).to eq(ec_key)
+    end
+
     it 'raises if private key is unsupported' do
-      ec_key = OpenSSL::PKey::EC.new
+      dsa_key = OpenSSL::PKey::DSA.new
       expect {
-        subject.create_context(config.merge(private_key: ec_key))
-      }.to raise_error(Puppet::SSL::SSLError, /Unsupported key 'OpenSSL::PKey::EC'/)
+        subject.create_context(config.merge(private_key: dsa_key))
+      }.to raise_error(Puppet::SSL::SSLError, /Unsupported key 'OpenSSL::PKey::DSA'/)
     end
 
     it 'resolves the client chain from leaf to root' do
@@ -352,8 +353,8 @@ describe Puppet::SSL::SSLProvider do
     let(:doesnt_exist) { '/does/not/exist' }
 
     before :each do
-      Puppet[:localcacert] = as_pem_file(global_cacerts.first)
-      Puppet[:hostcrl] = as_pem_file(global_crls.first)
+      Puppet[:localcacert] = file_containing('global_cacerts', global_cacerts.first.to_pem)
+      Puppet[:hostcrl] = file_containing('global_crls', global_crls.first.to_pem)
 
       Puppet[:certname] = 'signed'
       Puppet[:privatekeydir] = tmpdir('privatekeydir')
@@ -400,6 +401,30 @@ describe Puppet::SSL::SSLProvider do
         subject.load_context
       }.to raise_error(Puppet::Error, /The client certificate is missing from/)
     end
+
+    it 'loads the private key and client cert' do
+      ssl_context = subject.load_context
+
+      expect(ssl_context.private_key).to be_an(OpenSSL::PKey::RSA)
+      expect(ssl_context.client_cert).to be_an(OpenSSL::X509::Certificate)
+    end
+
+    it 'loads a password protected key and client cert' do
+      FileUtils.cp(File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'encrypted-key.pem'), File.join(Puppet[:privatekeydir], 'signed.pem'))
+
+      ssl_context = subject.load_context(password: '74695716c8b6')
+
+      expect(ssl_context.private_key).to be_an(OpenSSL::PKey::RSA)
+      expect(ssl_context.client_cert).to be_an(OpenSSL::X509::Certificate)
+    end
+
+    it 'raises if the password is incorrect' do
+      FileUtils.cp(File.join(PuppetSpec::FIXTURE_DIR, 'ssl', 'encrypted-key.pem'), File.join(Puppet[:privatekeydir], 'signed.pem'))
+
+      expect {
+        subject.load_context(password: 'wrongpassword')
+      }.to raise_error(Puppet::SSL::SSLError, /Failed to load private key for host 'signed': Could not parse PKey/)
+    end
   end
 
   context 'when verifying requests' do

data/spec/unit/ssl/state_machine_spec.rb

@@ -1,4 +1,5 @@
 require 'spec_helper'
+require 'webmock/rspec'
 require 'puppet_spec/files'
 
 require 'puppet/ssl'
@@ -6,11 +7,7 @@ require 'puppet/ssl'
 describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
   include PuppetSpec::Files
 
-  let(:privatekeydir) { tmpdir('privatekeydir') }
-  let(:certdir) { tmpdir('certdir') }
-  let(:requestdir) { tmpdir('requestdir') }
-  let(:machine) { described_class.new }
-  let(:cert_provider) { Puppet::X509::CertProvider.new(privatekeydir: privatekeydir, certdir: certdir, requestdir: requestdir) }
+  let(:cert_provider) { Puppet::X509::CertProvider.new }
   let(:ssl_provider) { Puppet::SSL::SSLProvider.new }
   let(:machine) { described_class.new(cert_provider: cert_provider, ssl_provider: ssl_provider) }
   let(:cacert_pem) { cacert.to_pem }
@@ -24,10 +21,13 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
   let(:private_key) { key_fixture('signed-key.pem') }
   let(:client_cert) { cert_fixture('signed.pem') }
 
-  let(:refused_message) { %r{Connection refused|No connection could be made because the target machine actively refused it} }
-
   before(:each) do
-    allow(Kernel).to receive(:sleep)
+    WebMock.disable_net_connect!
+
+    allow_any_instance_of(Net::HTTP).to receive(:start)
+    allow_any_instance_of(Net::HTTP).to receive(:finish)
+
+    Puppet[:ssl_lockfile] = tmpfile('ssllock')
   end
 
   context 'when ensuring CA certs and CRLs' do
@@ -41,48 +41,6 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       expect(ssl_context[:crls]).to eq(crls)
       expect(ssl_context[:verify_peer]).to eq(true)
     end
-
-    context 'when exceptions occur' do
-      it 'raises in onetime mode' do
-        stub_request(:get, %r{puppet-ca/v1/certificate/ca})
-          .to_raise(Errno::ECONNREFUSED)
-
-        machine = described_class.new(cert_provider: cert_provider, ssl_provider: ssl_provider, onetime: true)
-        expect {
-          machine.ensure_ca_certificates
-        }.to raise_error(Puppet::Error, refused_message)
-      end
-
-      it 'retries CA cert download' do
-        # allow cert to be saved to disk
-        FileUtils.mkdir_p(Puppet[:certdir])
-        allow(cert_provider).to receive(:load_crls).and_return(crls)
-
-        req = stub_request(:get, %r{puppet-ca/v1/certificate/ca})
-                .to_raise(Errno::ECONNREFUSED).then
-                .to_return(status: 200, body: cacert_pem)
-
-        machine.ensure_ca_certificates
-
-        expect(req).to have_been_made.twice
-        expect(@logs).to include(an_object_having_attributes(message: refused_message))
-      end
-
-      it 'retries CRL download' do
-        # allow crl to be saved to disk
-        FileUtils.mkdir_p(Puppet[:ssldir])
-        allow(cert_provider).to receive(:load_cacerts).and_return(cacerts)
-
-        req = stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca})
-                .to_raise(Errno::ECONNREFUSED).then
-                .to_return(status: 200, body: crl_pem)
-
-        machine.ensure_ca_certificates
-
-        expect(req).to have_been_made.twice
-        expect(@logs).to include(an_object_having_attributes(message: refused_message))
-      end
-    end
   end
 
   context 'when ensuring a client cert' do
@@ -100,71 +58,73 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       expect(ssl_context[:private_key]).to eq(private_key)
       expect(ssl_context[:client_cert]).to eq(client_cert)
     end
+  end
 
-    context 'when exceptions occur' do
-      before :each do
-        allow(cert_provider).to receive(:load_cacerts).and_return(cacerts)
-        allow(cert_provider).to receive(:load_crls).and_return(crls)
-      end
+  context 'when locking' do
+    let(:lockfile) { double('ssllockfile') }
+    let(:machine) { described_class.new(cert_provider: cert_provider, ssl_provider: ssl_provider, lockfile: lockfile) }
 
-      it 'retries CSR submission' do
-        allow(cert_provider).to receive(:load_private_key).and_return(private_key)
-        allow($stdout).to receive(:puts).with(/Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate/)
+    # lockfile is deleted before `ensure_ca_certificates` returns, so
+    # verify lockfile contents while state machine is running
+    def expect_lockfile_to_contain(pid)
+      allow(cert_provider).to receive(:load_cacerts) do
+        expect(File.read(Puppet[:ssl_lockfile])).to eq(pid.to_s)
+      end.and_return(cacerts)
+      allow(cert_provider).to receive(:load_crls).and_return(crls)
+    end
 
-        stub_request(:get, %r{puppet-ca/v1/certificate/#{Puppet[:certname]}})
-          .to_return(status: 200, body: client_cert.to_pem)
-        # first request raises, second succeeds
-        req = stub_request(:put, %r{puppet-ca/v1/certificate_request/#{Puppet[:certname]}})
-                .to_raise(Errno::ECONNREFUSED).then
-                .to_return(status: 200)
+    it 'locks the file prior to running the state machine and unlocks when done' do
+      expect(lockfile).to receive(:lock).and_return(true).ordered
+      expect(cert_provider).to receive(:load_cacerts).and_return(cacerts).ordered
+      expect(cert_provider).to receive(:load_crls).and_return(crls).ordered
+      expect(lockfile).to receive(:unlock).ordered
 
-        machine.ensure_client_certificate
+      machine.ensure_ca_certificates
+    end
 
-        expect(req).to have_been_made.twice
-        expect(@logs).to include(an_object_having_attributes(message: refused_message))
-      end
+    it 'deletes the lockfile when finished' do
+      allow(cert_provider).to receive(:load_cacerts).and_return(cacerts)
+      allow(cert_provider).to receive(:load_crls).and_return(crls)
 
-      it 'retries client cert download' do
-        allow(cert_provider).to receive(:load_private_key).and_return(private_key)
+      machine = described_class.new(cert_provider: cert_provider, ssl_provider: ssl_provider)
+      machine.ensure_ca_certificates
 
-        # first request raises, second succeeds
-        req = stub_request(:get, %r{puppet-ca/v1/certificate/#{Puppet[:certname]}})
-                .to_raise(Errno::ECONNREFUSED).then
-                .to_return(status: 200, body: client_cert.to_pem)
-        stub_request(:put, %r{puppet-ca/v1/certificate_request/#{Puppet[:certname]}}).to_return(status: 200)
+      expect(File).to_not be_exist(Puppet[:ssl_lockfile])
+    end
 
-        machine.ensure_client_certificate
+    it 'raises an exception when locking fails' do
+      allow(lockfile).to receive(:lock).and_return(false)
+      expect {
+        machine.ensure_ca_certificates
+      }.to raise_error(Puppet::Error, /Another puppet instance is already running; exiting/)
+    end
 
-        expect(req).to have_been_made.twice
-        expect(@logs).to include(an_object_having_attributes(message: refused_message))
-      end
+    it 'acquires an empty lockfile' do
+      Puppet::FileSystem.touch(Puppet[:ssl_lockfile])
 
-      it 'retries when client cert and private key are mismatched' do
-        allow(cert_provider).to receive(:load_private_key).and_return(private_key)
+      expect_lockfile_to_contain(Process.pid)
 
-        # return mismatched cert the first time, correct cert second time
-        req = stub_request(:get, %r{puppet-ca/v1/certificate/#{Puppet[:certname]}})
-                .to_return(status: 200, body: cert_fixture('pluto.pem').to_pem)
-                .to_return(status: 200, body: client_cert.to_pem)
-        stub_request(:put, %r{puppet-ca/v1/certificate_request/#{Puppet[:certname]}}).to_return(status: 200)
+      machine = described_class.new(cert_provider: cert_provider, ssl_provider: ssl_provider)
+      machine.ensure_ca_certificates
+    end
 
-        machine.ensure_client_certificate
+    it 'acquires its own lockfile' do
+      File.write(Puppet[:ssl_lockfile], Process.pid.to_s)
 
-        expect(req).to have_been_made.twice
-        expect(@logs).to include(an_object_having_attributes(message: %r{The certificate for 'CN=pluto' does not match its private key}))
-      end
+      expect_lockfile_to_contain(Process.pid)
 
-      it 'raises in onetime mode' do
-        stub_request(:get, %r{puppet-ca/v1/certificate/#{Puppet[:certname]}})
-          .to_raise(Errno::ECONNREFUSED)
-        stub_request(:put, %r{puppet-ca/v1/certificate_request/#{Puppet[:certname]}})
-          .to_return(status: 200)
+      machine = described_class.new(cert_provider: cert_provider, ssl_provider: ssl_provider)
+      machine.ensure_ca_certificates
+    end
 
-        machine = described_class.new(cert_provider: cert_provider, ssl_provider: ssl_provider, onetime: true)
-        expect {
-          machine.ensure_client_certificate
-        }.to raise_error(Puppet::Error, refused_message)
-      end
+    it 'overwrites a stale lockfile' do
+      # 2**31 - 1 chosen to not conflict with existing pid
+      File.write(Puppet[:ssl_lockfile], "2147483647")
+
+      expect_lockfile_to_contain(Process.pid)
+
+      machine = described_class.new(cert_provider: cert_provider, ssl_provider: ssl_provider)
+      machine.ensure_ca_certificates
     end
   end
 
@@ -207,29 +167,29 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       state.next_state
     end
 
-    it 'returns an Error if the server returns 404' do
+    it 'raises if the server returns 404' do
       stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 404)
 
-      st = state.next_state
-      expect(st).to be_an_instance_of(Puppet::SSL::StateMachine::Error)
-      expect(st.message).to eq("CA certificate is missing from the server")
+      expect {
+        state.next_state
+      }.to raise_error(Puppet::Error, /CA certificate is missing from the server/)
     end
 
-    it 'returns an Error if there is a different exception' do
+    it 'raises if there is a different error' do
       stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: [500, 'Internal Server Error'])
 
-      st = state.next_state
-      expect(st).to be_an_instance_of(Puppet::SSL::StateMachine::Error)
-      expect(st.message).to eq("Could not download CA certificate: Internal Server Error")
+      expect {
+        state.next_state
+      }.to raise_error(Puppet::Error, /Could not download CA certificate: Internal Server Error/)
     end
 
-    it 'returns an Error if CA certs are invalid' do
+    it 'raises if CA certs are invalid' do
       allow(cert_provider).to receive(:load_cacerts).and_return(nil)
       stub_request(:get, %r{puppet-ca/v1/certificate/ca}).to_return(status: 200, body: '')
 
-      st = state.next_state
-      expect(st).to be_an_instance_of(Puppet::SSL::StateMachine::Error)
-      expect(st.error).to be_an_instance_of(OpenSSL::X509::CertificateError)
+      expect {
+        state.next_state
+      }.to raise_error(OpenSSL::X509::CertificateError)
     end
 
     it 'does not save invalid CA certs' do
@@ -284,29 +244,29 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       state.next_state
     end
 
-    it 'returns an Error if the server returns 404' do
+    it 'raises if the server returns 404' do
       stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 404)
 
-      st = state.next_state
-      expect(st).to be_an_instance_of(Puppet::SSL::StateMachine::Error)
-      expect(st.message).to eq("CRL is missing from the server")
+      expect {
+        state.next_state
+      }.to raise_error(Puppet::Error, /CRL is missing from the server/)
     end
 
-    it 'returns an Error if there is a different exception' do
+    it 'raises if there is a different error' do
       stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: [500, 'Internal Server Error'])
 
-      st = state.next_state
-      expect(st).to be_an_instance_of(Puppet::SSL::StateMachine::Error)
-      expect(st.message).to eq("Could not download CRLs: Internal Server Error")
+      expect {
+        state.next_state
+      }.to raise_error(Puppet::Error, /Could not download CRLs: Internal Server Error/)
     end
 
-    it 'returns an Error if CRLs are invalid' do
+    it 'raises if CRLs are invalid' do
       allow(cert_provider).to receive(:load_crls).and_return(nil)
       stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: '')
 
-      st = state.next_state
-      expect(st).to be_an_instance_of(Puppet::SSL::StateMachine::Error)
-      expect(st.error).to be_an_instance_of(OpenSSL::X509::CRLError)
+      expect {
+        state.next_state
+      }.to raise_error(OpenSSL::X509::CRLError)
     end
 
     it 'does not save invalid CRLs' do
@@ -330,6 +290,69 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
 
       expect(File).to_not exist(Puppet[:hostcrl])
     end
+
+    it 'skips CRL refresh by default' do
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_crls).and_return(crls)
+
+      state.next_state
+    end
+
+    it 'skips CRL refresh if it has not expired' do
+      Puppet[:crl_refresh_interval] = '1y'
+      Puppet::FileSystem.touch(Puppet[:hostcrl], mtime: Time.now)
+
+      allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_crls).and_return(crls)
+
+      state.next_state
+    end
+
+    context 'when refreshing a CRL' do
+      before :each do
+        Puppet[:crl_refresh_interval] = '1s'
+        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:load_crls).and_return(crls)
+
+        yesterday = Time.now - (24 * 60 * 60)
+        allow_any_instance_of(Puppet::X509::CertProvider).to receive(:crl_last_update).and_return(yesterday)
+      end
+
+      let(:new_crl_bundle) do
+        # add intermediate crl to the bundle
+        int_crl = crl_fixture('intermediate-crl.pem')
+        [crl, int_crl].map(&:to_pem)
+      end
+
+      it 'uses the local crl if it has not been modified' do
+        stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 304)
+
+        expect(state.next_state.ssl_context.crls).to eq(crls)
+      end
+
+      it 'uses the local crl if refreshing fails in HTTP layer' do
+        stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 503)
+
+        expect(state.next_state.ssl_context.crls).to eq(crls)
+      end
+
+      it 'uses the local crl if refreshing fails in TCP layer' do
+        stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_raise(Errno::ECONNREFUSED)
+
+        expect(state.next_state.ssl_context.crls).to eq(crls)
+      end
+
+      it 'uses the updated crl for the future requests' do
+        stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: new_crl_bundle.join)
+
+        expect(state.next_state.ssl_context.crls.map(&:to_pem)).to eq(new_crl_bundle)
+      end
+
+      it 'updates the `last_update` time' do
+        stub_request(:get, %r{puppet-ca/v1/certificate_revocation_list/ca}).to_return(status: 200, body: new_crl_bundle.join)
+
+        expect_any_instance_of(Puppet::X509::CertProvider).to receive(:crl_last_update=).with(be_within(60).of(Time.now))
+
+        state.next_state
+      end
+    end
   end
 
   context 'when ensuring a client cert' do
@@ -362,7 +385,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
         }.to raise_error(Puppet::SSL::SSLError, %r{The certificate for 'CN=signed' does not match its private key})
       end
 
-      it 'generates a new private key, saves it and passes it to the next state' do
+      it 'generates a new RSA private key, saves it and passes it to the next state' do
         allow(cert_provider).to receive(:load_private_key).and_return(nil)
         expect(cert_provider).to receive(:save_private_key)
 
@@ -372,6 +395,41 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
         expect(st.private_key).to be_private
       end
 
+      it 'generates a new EC private key, saves it and passes it to the next state' do
+        Puppet[:key_type] = 'ec'
+        allow(cert_provider).to receive(:load_private_key).and_return(nil)
+        expect(cert_provider).to receive(:save_private_key)
+
+        st = state.next_state
+        expect(st).to be_instance_of(Puppet::SSL::StateMachine::NeedSubmitCSR)
+        expect(st.private_key).to be_instance_of(OpenSSL::PKey::EC)
+        expect(st.private_key).to be_private
+        expect(st.private_key.group.curve_name).to eq('prime256v1')
+      end
+
+      it 'generates a new EC private key with curve `secp384r1`, saves it and passes it to the next state' do
+        Puppet[:key_type] = 'ec'
+        Puppet[:named_curve] = 'secp384r1'
+        allow(cert_provider).to receive(:load_private_key).and_return(nil)
+        expect(cert_provider).to receive(:save_private_key)
+
+        st = state.next_state
+        expect(st).to be_instance_of(Puppet::SSL::StateMachine::NeedSubmitCSR)
+        expect(st.private_key).to be_instance_of(OpenSSL::PKey::EC)
+        expect(st.private_key).to be_private
+        expect(st.private_key.group.curve_name).to eq('secp384r1')
+      end
+
+      it 'raises if the named curve is unsupported' do
+        Puppet[:key_type] = 'ec'
+        Puppet[:named_curve] = 'infiniteloop'
+        allow(cert_provider).to receive(:load_private_key).and_return(nil)
+
+        expect {
+          state.next_state
+        }.to raise_error(OpenSSL::PKey::ECError, /(invalid|unknown) curve name/)
+      end
+
       it 'raises an error if it fails to load the key' do
         allow(cert_provider).to receive(:load_private_key).and_raise(OpenSSL::PKey::RSAError)
 
@@ -386,9 +444,7 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       let(:state) { Puppet::SSL::StateMachine::NeedSubmitCSR.new(machine, ssl_context, private_key) }
 
       def write_csr_attributes(data)
-        csr_yaml = tmpfile('state_machine_csr')
-        File.write(csr_yaml, YAML.dump(data))
-        csr_yaml
+        file_containing('state_machine_csr', YAML.dump(data))
       end
 
       before :each do
@@ -487,9 +543,9 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
       it 'raises if the server errors' do
         stub_request(:put, %r{puppet-ca/v1/certificate_request/#{Puppet[:certname]}}).to_return(status: 500)
 
-        st = state.next_state
-        expect(st).to be_an_instance_of(Puppet::SSL::StateMachine::Error)
-        expect(st.message).to eq("Failed to submit the CSR, HTTP response was 500")
+        expect {
+          state.next_state
+        }.to raise_error(Puppet::SSL::SSLError, /Failed to submit the CSR, HTTP response was 500/)
       end
 
       it "verifies the server's certificate when submitting the CSR" do
@@ -516,27 +572,16 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
         expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::Done)
       end
 
-      it "prints a message if the cert isn't signed yet" do
-        stub_request(:get, %r{puppet-ca/v1/certificate/#{Puppet[:certname]}}).to_return(status: 404)
-
-        expect {
-          state.next_state
-        }.to output(/Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate \(#{Puppet[:certname]}\)/).to_stdout
-      end
-
-      it 'transitions to Error if the cert does not match our private key' do
+      it 'transitions to Wait if the cert does not match our private key' do
         wrong_cert = cert_fixture('127.0.0.1.pem')
         stub_request(:get, %r{puppet-ca/v1/certificate/#{Puppet[:certname]}}).to_return(status: 200, body: wrong_cert.to_pem)
 
-        st = state.next_state
-        expect(st).to be_an_instance_of(Puppet::SSL::StateMachine::Error)
-        expect(st.message).to eq("The certificate for 'CN=127.0.0.1' does not match its private key")
+        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::Wait)
       end
 
       it 'transitions to Wait if the server returns non-200' do
         stub_request(:get, %r{puppet-ca/v1/certificate/#{Puppet[:certname]}}).to_return(status: 404)
 
-        allow($stdout).to receive(:puts).with(/Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate/)
         expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::Wait)
       end
 
@@ -556,9 +601,9 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
           MIIBpDCCAQ2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAfMR0wGwYDVQQDDBRUZXN0
         END
 
-        st = state.next_state
-        expect(st).to be_an_instance_of(Puppet::SSL::StateMachine::Error)
-        expect(st.message).to match(/Failed to parse certificate:/)
+        state.next_state
+
+        expect(@logs).to include(an_object_having_attributes(message: /Failed to parse certificate: /))
         expect(File).to_not exist(Puppet[:hostcert])
       end
 
@@ -566,9 +611,9 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
         wrong_cert = cert_fixture('127.0.0.1.pem').to_pem
         stub_request(:get, %r{puppet-ca/v1/certificate/#{Puppet[:certname]}}).to_return(status: 200, body: wrong_cert)
 
-        st = state.next_state
-        expect(st).to be_an_instance_of(Puppet::SSL::StateMachine::Error)
-        expect(st.message).to eq("The certificate for 'CN=127.0.0.1' does not match its private key")
+        state.next_state
+
+        expect(@logs).to include(an_object_having_attributes(message: %r{The certificate for 'CN=127.0.0.1' does not match its private key}))
         expect(File).to_not exist(Puppet[:hostcert])
       end
 
@@ -576,9 +621,9 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
         revoked_cert = cert_fixture('revoked.pem').to_pem
         stub_request(:get, %r{puppet-ca/v1/certificate/#{Puppet[:certname]}}).to_return(status: 200, body: revoked_cert)
 
-        st = state.next_state
-        expect(st).to be_an_instance_of(Puppet::SSL::StateMachine::Error)
-        expect(st.message).to eq("Certificate 'CN=revoked' is revoked")
+        state.next_state
+
+        expect(@logs).to include(an_object_having_attributes(message: %r{Certificate 'CN=revoked' is revoked}))
         expect(File).to_not exist(Puppet[:hostcert])
       end
     end
@@ -591,21 +636,51 @@ describe Puppet::SSL::StateMachine, unless: Puppet::Util::Platform.jruby? do
 
         expect {
           expect {
-            Puppet::SSL::StateMachine::Wait.new(machine).next_state
+            Puppet::SSL::StateMachine::Wait.new(machine, ssl_context).next_state
           }.to exit_with(1)
-        }.to output(/Exiting now because the waitforcert setting is set to 0./).to_stdout
+        }.to output(/Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate \(.*\). Exiting now because the waitforcert setting is set to 0./).to_stdout
       end
 
       it 'sleeps and transitions to NeedCACerts' do
         machine = described_class.new(waitforcert: 15)
 
-        state = Puppet::SSL::StateMachine::Wait.new(machine)
-        expect(Kernel).to receive(:sleep).with(15)
+        state = Puppet::SSL::StateMachine::Wait.new(machine, ssl_context)
+        expect(state).to receive(:sleep).with(15)
+
+        expect(Puppet).to receive(:info).with(/Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate \(.*\). Will try again in 15 seconds./)
+
+        expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedCACerts)
+      end
+
+      it 'sleeps and transitions to NeedCACerts when maxwaitforcert is set' do
+        machine = described_class.new(waitforcert: 15, maxwaitforcert: 30)
+
+        state = Puppet::SSL::StateMachine::Wait.new(machine, ssl_context)
+        expect(state).to receive(:sleep).with(15)
 
-        expect(Puppet).to receive(:info).with(/Will try again in 15 seconds./)
+        expect(Puppet).to receive(:info).with(/Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate \(.*\). Will try again in 15 seconds./)
 
         expect(state.next_state).to be_an_instance_of(Puppet::SSL::StateMachine::NeedCACerts)
       end
+
+      it 'waits indefinitely by default' do
+        machine = described_class.new
+        expect(machine.wait_deadline).to eq(Float::INFINITY)
+      end
+
+      it 'exits with 1 if maxwaitforcert is exceeded' do
+        machine = described_class.new(maxwaitforcert: 1)
+
+        # 5 minutes in the future
+        future = Time.now + (5 * 60)
+        allow(Time).to receive(:now).and_return(future)
+
+        expect {
+          expect {
+            Puppet::SSL::StateMachine::Wait.new(machine, ssl_context).next_state
+          }.to exit_with(1)
+        }.to output(/Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate \(.*\). Exiting now because the maxwaitforcert timeout has been exceeded./).to_stdout
+      end
     end
   end
 end