puppetlabs/puppetlabs-apache — pull request #913 by vinzent (2014-10-24 12:09:28+00:00)
Title: (MODULES-1457) apache::vhost: SSLCACertificatePath can't be unset

The SSLCACertificatePath is always set. The check for @ssl_certs_dir only
covers "undef". As there is a default value in ::apache::params for
ssl_certs_dir it needs to be overriden with an empty string.

Right now the _ssl.erb template outputs 'SSLCACertificatePath ""' for an empty
string, which triggers a failing reload of httpd.

This patch just adds a "&& @ssl_certs_dir != ''" to the condition.

On a Puppet master passenger vhost it's probably security relevant setting,
as it enables all system CA signed certificates access.

Related patch: https://github.com/puppetlabs/puppetlabs-apache/pull/787