puppetserver-ca 1.1.3 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0a642b5be01fd4809412f6c70928f1764a8ed294
-  data.tar.gz: edb6b327dc31c877cc69fce0cd9382e73082409d
+  metadata.gz: 738624da584684a68fc407803548fb3d4b6855aa
+  data.tar.gz: cb3ff01a01b44468687668a39ca957d7496038a4
 SHA512:
-  metadata.gz: 6a05b9d88d88098766164e3fc834343461de20d81858a65523e8ad53f179c7f56a4d5b5a43ecdae63e59d1d8ba959ff9ea007e58f4ca1d559d758b2786f4db21
-  data.tar.gz: 803bacaad5099f629adeb64cdb86ea711e4a14235714836f9fccd6746fae9d84e66252d51d907d4e15378a5dc6271772b1bc7289e0ce3c996ad9d061cfe9f9cc
+  metadata.gz: 8ba3e5d5f070022ed1c2d88cc388b18de694782846a836490c3309cd7fe1fa85cfe60943ead8f422911920638ae84099d471b734bf39191e1ea8901d605aaa0d
+  data.tar.gz: e0ec48b8a594b342e47962addc05c0b08976aa06bc335a63c181dc1fd2dbab60cca1a5cd38ebd7b911c8713c2675ac6029fbd6fa9b9e2007939a42dc1841902a

data/lib/puppetserver/ca/action/clean.rb

@@ -1,10 +1,11 @@
-require 'puppetserver/ca/utils/cli_parsing'
-require 'puppetserver/ca/utils/file_system'
-require 'puppetserver/ca/config/puppet'
+require 'optparse'
+
 require 'puppetserver/ca/action/revoke'
 require 'puppetserver/ca/certificate_authority'
-
-require 'optparse'
+require 'puppetserver/ca/config/puppet'
+require 'puppetserver/ca/errors'
+require 'puppetserver/ca/utils/cli_parsing'
+require 'puppetserver/ca/utils/file_system'
 
 module Puppetserver
   module Ca
@@ -22,10 +23,10 @@ Usage:
   puppetserver ca clean [--config] --certname NAME[,NAME]
 
 Description:
-Given one or more valid certnames, instructs the CA to revoke certificates
-matching the given certnames if they exist, and then remove files pertaining
-to them (keys, cert, and certificate request) over HTTPS using the local
-agent's PKI
+  Given one or more valid certnames, instructs the CA to revoke certificates
+  matching the given certnames if they exist, and then remove files pertaining
+  to them (keys, cert, and certificate request) over HTTPS using the local
+  agent's PKI
 
 Options:
 BANNER
@@ -68,7 +69,7 @@ BANNER
             errors << '  At least one certname is required to clean'
           end
 
-          errors_were_handled = CliParsing.handle_errors(@logger, errors, parser.help)
+          errors_were_handled = Errors.handle_with_usage(@logger, errors, parser.help)
 
           exit_code = errors_were_handled ? 1 : nil
 
@@ -81,11 +82,11 @@ BANNER
 
           if config
             errors = FileSystem.validate_file_paths(config)
-            return 1 if CliParsing.handle_errors(@logger, errors)
+            return 1 if Errors.handle_with_usage(@logger, errors)
           end
 
           puppet = Config::Puppet.parse(config)
-          return 1 if CliParsing.handle_errors(@logger, puppet.errors)
+          return 1 if Errors.handle_with_usage(@logger, puppet.errors)
 
           result = clean_certs(certnames, puppet.settings)
           case result

data/lib/puppetserver/ca/action/generate.rb

@@ -1,12 +1,13 @@
-require 'puppetserver/ca/utils/cli_parsing'
-require 'puppetserver/ca/host'
 require 'puppetserver/ca/certificate_authority'
-require 'puppetserver/ca/local_certificate_authority'
-require 'puppetserver/ca/x509_loader'
 require 'puppetserver/ca/config/puppet'
+require 'puppetserver/ca/errors'
+require 'puppetserver/ca/host'
+require 'puppetserver/ca/local_certificate_authority'
+require 'puppetserver/ca/utils/cli_parsing'
+require 'puppetserver/ca/utils/config'
 require 'puppetserver/ca/utils/file_system'
 require 'puppetserver/ca/utils/signing_digest'
-require 'puppetserver/ca/utils/config'
+require 'puppetserver/ca/x509_loader'
 
 module Puppetserver
   module Ca
@@ -28,25 +29,25 @@ Usage:
                            [--ca-client]
 
 Description:
-Generates a new certificate signed by the intermediate CA
-and stores generated keys and certs on disk.
-
-If the `--ca-client` flag is passed, the cert will be generated
-offline, without using Puppet Server's signing code, and will add
-a special extension authorizing it to talk to the CA API. This can
-be used for regenerating the master's host cert, or for manually
-setting up other nodes to be CA clients. Do not distribute certs
-generated this way to any node that you do not intend to have
-administrative access to the CA (e.g. the ability to sign a cert).
-
-Since the `--ca-client` causes a cert to be generated offline, it
-should ONLY be used when Puppet Server is NOT running, to avoid
-conflicting with the actions of the CA service. This will be
-mandatory in a future release.
-
-To determine the target location, the default puppet.conf
-is consulted for custom values. If using a custom puppet.conf
-provide it with the --config flag
+  Generates a new certificate signed by the intermediate CA
+  and stores generated keys and certs on disk.
+
+  If the `--ca-client` flag is passed, the cert will be generated
+  offline, without using Puppet Server's signing code, and will add
+  a special extension authorizing it to talk to the CA API. This can
+  be used for regenerating the master's host cert, or for manually
+  setting up other nodes to be CA clients. Do not distribute certs
+  generated this way to any node that you do not intend to have
+  administrative access to the CA (e.g. the ability to sign a cert).
+
+  Since the `--ca-client` causes a cert to be generated offline, it
+  should ONLY be used when Puppet Server is NOT running, to avoid
+  conflicting with the actions of the CA service. This will be
+  mandatory in a future release.
+
+  To determine the target location, the default puppet.conf
+  is consulted for custom values. If using a custom puppet.conf
+  provide it with the --config flag
 
 Options:
 BANNER
@@ -106,7 +107,7 @@ BANNER
             end
           end
 
-          errors_were_handled = CliParsing.handle_errors(@logger, errors, parser.help)
+          errors_were_handled = Errors.handle_with_usage(@logger, errors, parser.help)
 
           exit_code = errors_were_handled ? 1 : nil
 
@@ -120,14 +121,14 @@ BANNER
           # Validate config_path provided
           if config_path
             errors = FileSystem.validate_file_paths(config_path)
-            return 1 if CliParsing.handle_errors(@logger, errors)
+            return 1 if Errors.handle_with_usage(@logger, errors)
           end
 
           # Load, resolve, and validate puppet config settings
           settings_overrides = {}
           puppet = Config::Puppet.new(config_path)
           puppet.load(settings_overrides)
-          return 1 if CliParsing.handle_errors(@logger, puppet.errors)
+          return 1 if Errors.handle_with_usage(@logger, puppet.errors)
 
           # We don't want generate to respect the alt names setting, since it is usually
           # used to generate certs for other nodes
@@ -135,7 +136,7 @@ BANNER
 
           # Load most secure signing digest we can for csr signing.
           signer = SigningDigest.new
-          return 1 if CliParsing.handle_errors(@logger, signer.errors)
+          return 1 if Errors.handle_with_usage(@logger, signer.errors)
 
           # Generate and save certs and associated keys
           if input['ca-client']
@@ -152,7 +153,7 @@ BANNER
         # Returns true if it receives back a response of "running", and false if
         # no connection can be made, or a different response is received.
         def check_server_online(settings)
-          status_url = HttpClient::URL.new('https', settings[:server], settings[:masterport], 'status', 'v1', 'simple', 'ca')
+          status_url = HttpClient::URL.new('https', settings[:ca_server], settings[:ca_port], 'status', 'v1', 'simple', 'ca')
           begin
             # Generating certs offline is necessary if the master cert has been destroyed
             # or compromised. Since querying the status endpoint does not require a client cert, and
@@ -183,11 +184,11 @@ BANNER
                                   settings[:publickeydir]])
 
           ca = Puppetserver::Ca::LocalCertificateAuthority.new(digest, settings)
-          return false if CliParsing.handle_errors(@logger, ca.errors)
+          return false if Errors.handle_with_usage(@logger, ca.errors)
 
           passed = certnames.map do |certname|
             errors = check_for_existing_ssl_files(certname, settings)
-            next false if CliParsing.handle_errors(@logger, errors)
+            next false if Errors.handle_with_usage(@logger, errors)
 
             current_alt_names = process_alt_names(alt_names, certname)
 
@@ -221,7 +222,7 @@ BANNER
 
           passed = certnames.map do |certname|
             errors = check_for_existing_ssl_files(certname, settings)
-            next false if CliParsing.handle_errors(@logger, errors)
+            next false if Errors.handle_with_usage(@logger, errors)
 
             current_alt_names = process_alt_names(alt_names, certname)
 
@@ -273,7 +274,7 @@ BANNER
                                 key: private_key,
                                 cli_extensions: extensions,
                                 csr_attributes_path: settings[:csr_attributes])
-          return if CliParsing.handle_errors(@logger, host.errors)
+          return if Errors.handle_with_usage(@logger, host.errors)
 
           return private_key, csr
         end

data/lib/puppetserver/ca/action/import.rb

@@ -1,10 +1,12 @@
 require 'optparse'
-require 'puppetserver/ca/utils/file_system'
-require 'puppetserver/ca/x509_loader'
+
 require 'puppetserver/ca/config/puppet'
+require 'puppetserver/ca/errors'
 require 'puppetserver/ca/local_certificate_authority'
 require 'puppetserver/ca/utils/cli_parsing'
+require 'puppetserver/ca/utils/file_system'
 require 'puppetserver/ca/utils/signing_digest'
+require 'puppetserver/ca/x509_loader'
 
 module Puppetserver
   module Ca
@@ -21,15 +23,15 @@ Usage:
       --private-key PATH --cert-bundle PATH --crl-chain PATH
 
 Description:
-Given a private key, cert bundle, and a crl chain,
-validate and import to the Puppet Server CA.
+  Given a private key, cert bundle, and a crl chain,
+  validate and import to the Puppet Server CA.
 
-Note that the cert and crl provided for the leaf CA must not
-have already issued or revoked any certificates.
+  Note that the cert and crl provided for the leaf CA must not
+  have already issued or revoked any certificates.
 
-To determine the target location the default puppet.conf
-is consulted for custom values. If using a custom puppet.conf
-provide it with the --config flag
+  To determine the target location the default puppet.conf
+  is consulted for custom values. If using a custom puppet.conf
+  provide it with the --config flag
 
 Options:
 BANNER
@@ -47,10 +49,10 @@ BANNER
           files = [bundle_path, key_path, chain_path, config_path].compact
 
           errors = FileSystem.validate_file_paths(files)
-          return 1 if CliParsing.handle_errors(@logger, errors)
+          return 1 if Errors.handle_with_usage(@logger, errors)
 
           loader = X509Loader.new(bundle_path, key_path, chain_path)
-          return 1 if CliParsing.handle_errors(@logger, loader.errors)
+          return 1 if Errors.handle_with_usage(@logger, loader.errors)
 
           settings_overrides = {}
           settings_overrides[:certname] = input['certname'] unless input['certname'].empty?
@@ -58,14 +60,14 @@ BANNER
 
           puppet = Config::Puppet.new(config_path)
           puppet.load(settings_overrides)
-          return 1 if CliParsing.handle_errors(@logger, puppet.errors)
+          return 1 if Errors.handle_with_usage(@logger, puppet.errors)
 
           # Load most secure signing digest we can for cers/crl/csr signing.
           signer = SigningDigest.new
-          return 1 if CliParsing.handle_errors(@logger, signer.errors)
+          return 1 if Errors.handle_with_usage(@logger, signer.errors)
 
           errors = import(loader, puppet.settings, signer.digest)
-          return 1 if CliParsing.handle_errors(@logger, errors)
+          return 1 if Errors.handle_with_usage(@logger, errors)
 
           @logger.inform "Import succeeded. Find your files in #{puppet.settings[:cadir]}"
           return 0
@@ -152,7 +154,7 @@ ERR
             errors << err
           end
 
-          errors_were_handled = CliParsing.handle_errors(@logger, errors, parser.help)
+          errors_were_handled = Errors.handle_with_usage(@logger, errors, parser.help)
 
           exit_code = errors_were_handled ? 1 : nil
 

data/lib/puppetserver/ca/action/list.rb

@@ -1,9 +1,11 @@
-require 'puppetserver/ca/utils/cli_parsing'
-require 'puppetserver/ca/utils/file_system'
+require 'json'
+require 'optparse'
+
+require 'puppetserver/ca/errors'
 require 'puppetserver/ca/certificate_authority'
 require 'puppetserver/ca/config/puppet'
-require 'optparse'
-require 'json'
+require 'puppetserver/ca/utils/cli_parsing'
+require 'puppetserver/ca/utils/file_system'
 
 module Puppetserver
   module Ca
@@ -20,7 +22,8 @@ Usage:
   puppetserver ca list [--all]
 
 Description:
-List outstanding certificate requests. If --all is specified, signed and revoked certificates will be listed as well.
+  List outstanding certificate requests. If --all is specified, signed and
+  revoked certificates will be listed as well.
 
 Options:
       BANNER
@@ -51,11 +54,11 @@ Options:
 
           if config
             errors = FileSystem.validate_file_paths(config)
-            return 1 if CliParsing.handle_errors(@logger, errors)
+            return 1 if Errors.handle_with_usage(@logger, errors)
           end
 
           puppet = Config::Puppet.parse(config)
-          return 1 if CliParsing.handle_errors(@logger, puppet.errors)
+          return 1 if Errors.handle_with_usage(@logger, puppet.errors)
 
           all_certs = get_all_certs(puppet.settings)
           return 1 if all_certs.nil?
@@ -124,7 +127,7 @@ Options:
 
           errors = CliParsing.parse_with_errors(parser, args)
 
-          errors_were_handled = CliParsing.handle_errors(@logger, errors, parser.help)
+          errors_were_handled = Errors.handle_with_usage(@logger, errors, parser.help)
 
           exit_code = errors_were_handled ? 1 : nil
 

data/lib/puppetserver/ca/action/revoke.rb

@@ -1,9 +1,9 @@
+require 'optparse'
+
+require 'puppetserver/ca/certificate_authority'
+require 'puppetserver/ca/config/puppet'
 require 'puppetserver/ca/utils/cli_parsing'
 require 'puppetserver/ca/utils/file_system'
-require 'puppetserver/ca/config/puppet'
-require 'puppetserver/ca/certificate_authority'
-
-require 'optparse'
 
 module Puppetserver
   module Ca
@@ -21,8 +21,8 @@ Usage:
   puppetserver ca revoke [--config] --certname NAME[,NAME]
 
 Description:
-Given one or more valid certnames, instructs the CA to revoke them over
-HTTPS using the local agent's PKI
+  Given one or more valid certnames, instructs the CA to revoke them over
+  HTTPS using the local agent's PKI
 
 Options:
 BANNER
@@ -65,7 +65,7 @@ BANNER
             errors << '  At least one certname is required to revoke'
           end
 
-          errors_were_handled = CliParsing.handle_errors(@logger, errors, parser.help)
+          errors_were_handled = Errors.handle_with_usage(@logger, errors, parser.help)
 
           # if there is an exit_code then Cli will return it early, so we only
           # return an exit_code if there's an error
@@ -80,11 +80,11 @@ BANNER
 
           if config
             errors = FileSystem.validate_file_paths(config)
-            return 1 if CliParsing.handle_errors(@logger, errors)
+            return 1 if Errors.handle_with_usage(@logger, errors)
           end
 
           puppet = Config::Puppet.parse(config)
-          return 1 if CliParsing.handle_errors(@logger, puppet.errors)
+          return 1 if Errors.handle_with_usage(@logger, puppet.errors)
 
           result =  revoke_certs(certnames, puppet.settings)
 

data/lib/puppetserver/ca/action/setup.rb

@@ -1,9 +1,11 @@
 require 'optparse'
-require 'puppetserver/ca/utils/file_system'
+
+require 'puppetserver/ca/config/puppet'
+require 'puppetserver/ca/errors'
 require 'puppetserver/ca/local_certificate_authority'
 require 'puppetserver/ca/utils/cli_parsing'
+require 'puppetserver/ca/utils/file_system'
 require 'puppetserver/ca/utils/signing_digest'
-require 'puppetserver/ca/config/puppet'
 
 module Puppetserver
   module Ca
@@ -19,19 +21,19 @@ Usage:
                            [--certname NAME] [--ca-name NAME]
 
 Description:
-Setup a root and intermediate signing CA for Puppet Server
-and store generated CA keys, certs, crls, and associated
-master related files on disk.
+  Setup a root and intermediate signing CA for Puppet Server
+  and store generated CA keys, certs, crls, and associated
+  master related files on disk.
 
-The `--subject-alt-names` flag can be used to add SANs to the
-certificate generated for the Puppet master. Multiple names can be
-listed as a comma separated string. These can be either DNS names or
-IP addresses, differentiated by prefixes: `DNS:foo.bar.com,IP:123.456.789`.
-Names with no prefix will be treated as DNS names.
+  The `--subject-alt-names` flag can be used to add SANs to the
+  certificate generated for the Puppet master. Multiple names can be
+  listed as a comma separated string. These can be either DNS names or
+  IP addresses, differentiated by prefixes: `DNS:foo.bar.com,IP:123.456.789`.
+  Names with no prefix will be treated as DNS names.
 
-To determine the target location, the default puppet.conf
-is consulted for custom values. If using a custom puppet.conf
-provide it with the --config flag
+  To determine the target location, the default puppet.conf
+  is consulted for custom values. If using a custom puppet.conf
+  provide it with the --config flag
 
 Options:
 BANNER
@@ -45,7 +47,7 @@ BANNER
           config_path = input['config']
           if config_path
             errors = FileSystem.validate_file_paths(config_path)
-            return 1 if CliParsing.handle_errors(@logger, errors)
+            return 1 if Errors.handle_with_usage(@logger, errors)
           end
 
           # Load, resolve, and validate puppet config settings
@@ -58,16 +60,16 @@ BANNER
 
           puppet = Config::Puppet.new(config_path)
           puppet.load(settings_overrides)
-          return 1 if CliParsing.handle_errors(@logger, puppet.errors)
+          return 1 if Errors.handle_with_usage(@logger, puppet.errors)
 
           # Load most secure signing digest we can for cers/crl/csr signing.
           signer = SigningDigest.new
-          return 1 if CliParsing.handle_errors(@logger, signer.errors)
+          return 1 if Errors.handle_with_usage(@logger, signer.errors)
 
           # Generate root and intermediate ca and put all the certificates, crls,
           # and keys where they should go.
           errors = generate_pki(puppet.settings, signer.digest)
-          return 1 if CliParsing.handle_errors(@logger, errors)
+          return 1 if Errors.handle_with_usage(@logger, errors)
 
           @logger.inform "Generation succeeded. Find your files in #{puppet.settings[:cadir]}"
           return 0
@@ -144,7 +146,7 @@ ERR
           results = {}
           parser = self.class.parser(results)
           errors = CliParsing.parse_with_errors(parser, cli_args)
-          errors_were_handled = CliParsing.handle_errors(@logger, errors, parser.help)
+          errors_were_handled = Errors.handle_with_usage(@logger, errors, parser.help)
           exit_code = errors_were_handled ? 1 : nil
           return results, exit_code
         end

data/lib/puppetserver/ca/action/sign.rb

@@ -1,11 +1,12 @@
+require 'net/https'
+require 'openssl'
+require 'optparse'
+
+require 'puppetserver/ca/certificate_authority'
+require 'puppetserver/ca/config/puppet'
+require 'puppetserver/ca/errors'
 require 'puppetserver/ca/utils/cli_parsing'
 require 'puppetserver/ca/utils/file_system'
-require 'puppetserver/ca/config/puppet'
-require 'puppetserver/ca/certificate_authority'
-
-require 'optparse'
-require 'openssl'
-require 'net/https'
 
 module Puppetserver
   module Ca
@@ -22,7 +23,8 @@ Usage:
   puppetserver ca sign  --all
 
 Description:
-Given a comma-separated list of valid certnames, instructs the CA to sign each cert.
+  Given a comma-separated list of valid certnames, instructs the CA to sign
+  each cert.
 
 Options:
       BANNER
@@ -54,11 +56,11 @@ Options:
 
           if config
             errors = FileSystem.validate_file_paths(config)
-            return 1 if CliParsing.handle_errors(@logger, errors)
+            return 1 if Errors.handle_with_usage(@logger, errors)
           end
 
           puppet = Config::Puppet.parse(config)
-          return 1 if CliParsing.handle_errors(@logger, puppet.errors)
+          return 1 if Errors.handle_with_usage(@logger, puppet.errors)
 
           ca = Puppetserver::Ca::CertificateAuthority.new(@logger, puppet.settings)
 
@@ -113,7 +115,7 @@ Options:
             errors << err
           end
 
-          errors_were_handled = CliParsing.handle_errors(@logger, errors, parser.help)
+          errors_were_handled = Errors.handle_with_usage(@logger, errors, parser.help)
 
           exit_code = errors_were_handled ? 1 : nil
 

data/lib/puppetserver/ca/certificate_authority.rb

@@ -1,7 +1,7 @@
-require 'puppetserver/ca/utils/http_client'
-
 require 'json'
 
+require 'puppetserver/ca/utils/http_client'
+
 module Puppetserver
   module Ca
     class CertificateAuthority

data/lib/puppetserver/ca/cli.rb

@@ -1,4 +1,5 @@
 require 'optparse'
+
 require 'puppetserver/ca/action/clean'
 require 'puppetserver/ca/action/generate'
 require 'puppetserver/ca/action/import'
@@ -6,9 +7,10 @@ require 'puppetserver/ca/action/list'
 require 'puppetserver/ca/action/revoke'
 require 'puppetserver/ca/action/setup'
 require 'puppetserver/ca/action/sign'
+require 'puppetserver/ca/errors'
 require 'puppetserver/ca/logger'
-require 'puppetserver/ca/version'
 require 'puppetserver/ca/utils/cli_parsing'
+require 'puppetserver/ca/version'
 
 
 module Puppetserver
@@ -86,7 +88,14 @@ BANNER
           if exit_code
             return exit_code
           else
-            return action.run(input)
+            begin
+              return action.run(input)
+            rescue Puppetserver::Ca::Error => e
+              logger.err "Fatal error when running action '#{action_argument}'"
+              logger.err "  Error: " + e.message
+
+              return 1
+            end
           end
         else
           logger.warn "Unknown action: #{action_argument}"

data/lib/puppetserver/ca/config/puppet.rb

@@ -1,6 +1,7 @@
-require 'puppetserver/ca/utils/config'
-require 'securerandom'
 require 'facter'
+require 'securerandom'
+
+require 'puppetserver/ca/utils/config'
 
 module Puppetserver
   module Ca
@@ -66,8 +67,9 @@ module Puppetserver
           results ||= {}
           results[:main] ||= {}
           results[:master] ||= {}
+          results[:agent] ||= {}
 
-          overrides = results[:main].merge(results[:master])
+          overrides = results[:agent].merge(results[:main]).merge(results[:master])
           overrides.merge!(cli_overrides)
 
           @settings = resolve_settings(overrides).freeze
@@ -132,6 +134,7 @@ module Puppetserver
             :ca_ttl => '15y',
             :certificate_revocation => 'true',
             :signeddir => '$cadir/signed',
+            :server_list => '',
           }
 
           # This loops through the base defaults and gives each setting a
@@ -161,6 +164,11 @@ module Puppetserver
           settings[:certificate_revocation] = parse_crl_usage(settings[:certificate_revocation])
           settings[:subject_alt_names] = Puppetserver::Ca::Utils::Config.munge_alt_names(settings[:subject_alt_names])
           settings[:keylength] = settings[:keylength].to_i
+          settings[:server_list] = settings[:server_list].
+                                     split(/\s*,\s*/).
+                                     map {|entry| entry.split(":") }
+
+          update_for_server_list!(settings)
 
           settings.each do |key, value|
             next unless value.is_a? String
@@ -239,6 +247,20 @@ module Puppetserver
             :ignore
           end
         end
+
+        def update_for_server_list!(settings)
+          if settings.dig(:server_list, 0, 0) &&
+              settings[:ca_server] == '$server'
+
+            settings[:ca_server] = settings.dig(:server_list, 0, 0)
+          end
+
+          if settings.dig(:server_list, 0, 1) &&
+              settings[:ca_port] == '$masterport'
+
+            settings[:ca_port] = settings.dig(:server_list, 0, 1)
+          end
+        end
       end
     end
   end

data/lib/puppetserver/ca/config/puppetserver.rb

@@ -1,4 +1,5 @@
 require 'hocon'
+
 require 'puppetserver/ca/utils/config'
 
 module Puppetserver

data/lib/puppetserver/ca/errors.rb

@@ -0,0 +1,26 @@
+module Puppetserver
+  module Ca
+    class Error < StandardError; end
+    class FileNotFound < Error; end
+    class InvalidX509Object < Error; end
+    class ConnectionFailed < Error; end
+
+    module Errors
+      def self.handle_with_usage(log, errors, usage = nil)
+        unless errors.empty?
+          log.err 'Error:'
+          errors.each {|e| log.err e }
+
+          if usage
+            log.err ''
+            log.err usage
+          end
+
+          return true
+        else
+          return false
+        end
+      end
+    end
+  end
+end

data/lib/puppetserver/ca/host.rb

@@ -1,5 +1,5 @@
-require 'openssl'
 require 'fileutils'
+require 'openssl'
 require 'yaml'
 
 module Puppetserver

data/lib/puppetserver/ca/local_certificate_authority.rb

@@ -1,9 +1,9 @@
+require 'openssl'
+
 require 'puppetserver/ca/host'
 require 'puppetserver/ca/utils/file_system'
 require 'puppetserver/ca/x509_loader'
 
-require 'openssl'
-
 module Puppetserver
   module Ca
     class LocalCertificateAuthority

data/lib/puppetserver/ca/utils/cli_parsing.rb

@@ -50,21 +50,6 @@ module Puppetserver
           errors
         end
 
-        def self.handle_errors(log, errors, usage = nil)
-          unless errors.empty?
-            log.err 'Error:'
-            errors.each {|e| log.err e }
-
-            if usage
-              log.err ''
-              log.err usage
-            end
-
-            return true
-          else
-            return false
-          end
-        end
 
       private
 

data/lib/puppetserver/ca/utils/file_system.rb

@@ -1,5 +1,5 @@
-require 'fileutils'
 require 'etc'
+require 'fileutils'
 
 module Puppetserver
   module Ca

data/lib/puppetserver/ca/utils/http_client.rb

@@ -1,5 +1,7 @@
-require 'openssl'
 require 'net/https'
+require 'openssl'
+
+require 'puppetserver/ca/errors'
 
 module Puppetserver
   module Ca
@@ -31,12 +33,16 @@ module Puppetserver
           end
         end
 
-        def load_cert(cert_path)
-          OpenSSL::X509::Certificate.new(File.read(cert_path))
+        def load_cert(path)
+          load_with_errors(path, 'hostcert') do |content|
+            OpenSSL::X509::Certificate.new(content)
+          end
         end
 
-        def load_key(key_path)
-          OpenSSL::PKey.read(File.read(key_path))
+        def load_key(path)
+          load_with_errors(path, 'hostprivkey') do |content|
+            OpenSSL::PKey.read(content)
+          end
         end
 
         # Takes an instance URL (defined lower in the file), and creates a
@@ -46,13 +52,33 @@ module Puppetserver
         def with_connection(url, &block)
           request = ->(conn) { block.call(Connection.new(conn, url)) }
 
-          Net::HTTP.start(url.host, url.port,
-                          use_ssl: true, cert_store: @store,
-                          cert: @cert, key: @key,
-                          &request)
+          begin
+            Net::HTTP.start(url.host, url.port,
+                            use_ssl: true, cert_store: @store,
+                            cert: @cert, key: @key,
+                            &request)
+          rescue StandardError => e
+            raise ConnectionFailed.new(
+              "Failed connecting to #{url.full_url}\n" +
+              "  Root cause: #{e.message}")
+          end
         end
 
         private
+
+       def load_with_errors(path, setting, &block)
+          begin
+            content = File.read(path)
+            block.call(content)
+          rescue Errno::ENOENT
+            raise FileNotFound.new("Could not find '#{setting}' at '#{path}'")
+          rescue OpenSSL::OpenSSLError => e
+            raise InvalidX509Object.new(
+              "Could not parse '#{setting}' at '#{path}'.\n" +
+              "  OpenSSL returned: #{e.message}")
+          end
+       end
+
         # Helper class that wraps a Net::HTTP connection, a HttpClient::URL
         # and defines methods named after HTTP verbs that are called on the
         # saved connection, returning a Result.

data/lib/puppetserver/ca/version.rb

@@ -1,5 +1,5 @@
 module Puppetserver
   module Ca
-    VERSION = "1.1.3"
+    VERSION = "1.2.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puppetserver-ca
 version: !ruby/object:Gem::Version
-  version: 1.1.3
+  version: 1.2.0
 platform: ruby
 authors:
 - Puppet, Inc.
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-11-16 00:00:00.000000000 Z
+date: 2018-12-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: facter
@@ -103,6 +103,7 @@ files:
 - lib/puppetserver/ca/cli.rb
 - lib/puppetserver/ca/config/puppet.rb
 - lib/puppetserver/ca/config/puppetserver.rb
+- lib/puppetserver/ca/errors.rb
 - lib/puppetserver/ca/host.rb
 - lib/puppetserver/ca/local_certificate_authority.rb
 - lib/puppetserver/ca/logger.rb