My concern was what exactly is going to be in the peer_certs list. I've spent the last while digging around in the Ruby OpenSSL source trying to determine the return value of various ssl functions. My current understanding is that https://github.com/dalen/puppet/blob/62b937d26a5d677ceeea091fd2062aeafaa6dc73/lib/puppet/network/http/connection.rb#L55 is only going to return a single cert.

So is it just me or is peer_certs going to only contain a single certificate at any time or am I missing something?