puppetlabs/puppet — pull request #1572 by jeffmccune (2013-03-31 19:12:00+00:00)
Title: (#15561) Add External CA acceptance tests

This patch adds three acceptance tests:

1: Externally issued certificate chains work.
2: Email addresses in certificate names work.
3: Certificate revocation works.

+-----------------+
| Root CA |
| (Self Signed) |
+--+------------+-+
| |
+-----+ +------+
| |
v v
+-------------+ +------------+
| Issuing CA | | Issuing CA |
| For Masters | | For Agents |
+-------+-----+ +------+-----+
| |
| |
v v
+-------------+ +-------------+
| Master SSL | | Agent SSL |
| Certificate | | Certificate |
+-------------+ +-------------+

A master may restrict clients to those with a certificate issued by a
specific DN. For example, the Apache `SSLRequire %{SSL_CLIENT_I_DN_CN}
== "Agent CA"` directive will only allow agent with certificates issued
by "Agent CA"

These examples exercise Puppet agents checking for revoked master
certificates by populating a CRL file out of band.

Finally, subject names with email addresses in the name are checked in
an effort to prevent regressions on #15561. For example,
`CN=agent-email3.example.org/emailAddress=test@example.com`.

This fixture data is intended for, and supported on, EL-6 master hosts
with Apache 2.2 or later and Passenger 3.0.17 from EPEL.

This test is confined to the `el-6` platform.

Expected output on the agent when the master certificate has been
revoked is:

Error: Could not retrieve catalog from remote server:
SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed:
[certificate revoked for /CN=master1.example.org]
Error: Could not retrieve catalog; skipping run