puppetlabs/puppet — pull request #907 by jeffmccune (2012-07-05 23:32:28+00:00)
Title: (#7224) Fix error message ssl verification error message

Without this patch the error message displayed when a CA chain is being used
is incorrect. The error looks like:

err: Could not retrieve catalog from remote server: Server hostname
'maynard' did not match server certificate; expected jeff mccune
root authority/c=us/st=oregon/l=portland/o=puppet labs/ou=jeff
mccune/emailaddress=jeff@puppetlabs.com

This is incorrect because the wrong certificate has been selected from the
chain of certificates. The SSL server certificate itself needs to be
selected, not a CA certificate.

This patch fixes the problem by only using the last certificate in the chain
to display the error message. The error now looks like:

err: Could not retrieve catalog from remote server: Server hostname
'maynard' did not match server certificate; expected one of
maynard2, DNS:maynard.puppetlabs.lan, DNS:maynard2, DNS:puppet,
DNS:puppet.puppetlabs.lan

The spec tests have been augmented to load certificate data from fixture
data. This should speed up the testing a bit and has the added benefit of
being able to test CA chains in addition to self signed CA certificates.

To add additional test cases, simply drop new fixture data into
spec/fixtures/unit/indirector/rest/peer_cert_*.pem

The fixture file should be series of PEM encoded certificates separated by
"\n---\n" The CA's should be listed first and the master SSL certificate
listed last.