puppetlabs/puppet — pull request #3312 by dankreek (2014-11-14 17:44:46+00:00)
Title: (PUP-3560) Properly wrap trusted fact extensions 

The X.509 spec states that all extensions should de a DER data type wrapped inside of an DER octet string. Due to a bug in the OpenSSL::X509::Extension library we were previously just stuffing them into a DER octet string as unencoded raw data. This PR updates how we handle generating and parsing certificate requests (CSR) and also how we generate the certificates themselves.