These methods aren't available until Ruby 1.8.6 (Dir.mktmpdir) and Ruby 1.8.7
(Object#tap).

Reviewed-By: Jacob Helwig <jacob@puppetlabs.com>

This class was previously using a cached_attr for its 'localhost' attribute,
representing the Puppet::SSL::Host entry corresponding to the cert in
Puppet[:certname]. We now no longer expire this attribute. This has the effect
that a change to certname during the lifetime of an agent will not be reflected
in the certificate it uses. If this behavior is desired, it will need to be
reimplemented another way.

Reviewed-By: Jacob Helwig <jacob@puppetlabs.com>

Allowing the singleton_instance value to be expirable is unnecessary, because
there will never be a need for a different CA instance in the lifetime of a
master. Additionally, the master never expired its cache anyway. This was only
using the cacher so it could be expired for tests, so it can safely be removed.

Reviewed-By: Jacob Helwig <jacob@puppetlabs.com>

Our SSL inventory was able to find the serial number of a certificate by name,
but was incapable of living up to the contract it offered, that it would
actually report when a certificate was missing.

Now it returns `nil`, which is the same case as "no inventory", if the
certificate was not found, rather than accidentally returning the entire
inventory data as raw strings.

Reviewed-By: Pieter van de Bruggen <pieter@puppetlabs.com>

Alternate names, if present, are specified in the subjectAltName extension of
the certificate. The values are in the form:

"DNS:alternate_name1, DNS:alternate_name2"

This helper will retrieve the value of the subjectAltName extension and extract
the alternate names, returning and empty list if the extension is absent. This
will make it easier to access the entire list of possible names for a
certificate, rather than just the common name; this is helpful for generating
more detailed SSL error messages.

Paired-With: Jacob Helwig <jacob@puppetlabs.com>

This commit introduces a new Indirector terminus, certificate_status,
which allows for signing, revoking, listing, and cleaning
SSL certificates over HTTP via REST. Documentation for these new
features can be found in our REST API documentation on the docs site:

http://docs.puppetlabs.com/guides/rest_api.html

This documentation has not been updated as of the writing of this
commit, but will be very soon. Puppet::SSL::Host is now fully integrated
into the Indirector.

Paired-with:Matt Robinson, Jacob Helwig, Jesse Wolfe, Richard Crowley,
Luke Kanies

This change replaces calls to <model object>.save with calls to <model
class>.indirection.save(<model object>).  This makes the use of the
indirector explicit rather than implicit so that it will be easier to
search for all indirector call sites using grep.  This is an
intermediate refactor on the way towards allowing indirector calls to
be explicitly routed to multiple termini.

This patch affects production code.

Autosigning was previously accomplished by overriding
CertificateRequest#save.  This meant that it wouldn't work if
certificate requests were saved via a direct call to Indirection#save.
Changed it to use the indirector :extend mechanism, which works no
matter how the save is invoked.

Replaced uses of the find, search, destroy, and expire methods on
model classes with direct calls to the indirection objects.  Also
removed the old methods that delegated to the indirection object.

Having a root ca_name that matches the fqdn of the puppet master would
cause certificate lookup problems on some clients, resulting in failed SSL
negotiation.

Signed-off-by: Jacob Helwig <jacob@puppetlabs.com>