puppetlabs/puppet — pull request #3183 by AnchorCat (2014-10-13 04:00:26+00:00)
Title: (PUP-3446) Self-sign REST interface test x509 certificate

Not calling OpenSSL::X509::Certificate#sign on a new certificate
produces invalid ASN.1 output, as the signing algorithm fields are left
empty. Versions of OpenSSL prior to 1.0.1i accepted this invalid ASN.1,
which is why this problem went unnoticed. Without this patch, this test
fails on any system with OpenSSL 1.0.1i or newer.

This fix signs the certificate with the private key used to generate
it, producing a self-signed certificate with valid ASN.1. This allows
all tests to pass with OpenSSL 1.0.1i.