The SSL::Host class now uses the CA to generate its certificate when appropriate.

It uses the CA singleton method to determine
whether it's on valid CA host, and if so, uses
the CA instance to sign its generated CSR.

1 files changed, 8 insertions, 3 deletions

diff --git a/lib/puppet/ssl/host.rb b/lib/puppet/ssl/host.rb
index e89f21676..09086e0fa 100644
--- a/lib/puppet/ssl/host.rb
+++ b/lib/puppet/ssl/host.rb
@@ -146,9 +146,12 @@ class Puppet::SSL::Host
         generate_key unless key
         generate_certificate_request unless certificate_request
 
-        # Now try to find our actual certificate; this should hopefully get
-        # the cert from the server and then cache it locally.
-        certificate()
+        # If we can get a CA instance, then we're a valid CA, and we
+        # should use it to sign our request; else, just try to read
+        # the cert.
+        if ! certificate() and ca = Puppet::SSL::CertificateAuthority.instance
+            ca.sign(self.name)
+        end
     end
 
     def initialize(name = nil)
@@ -162,3 +165,5 @@ class Puppet::SSL::Host
         key.content.public_key
     end
 end
+
+require 'puppet/ssl/certificate_authority'