All SSL terminus classes now force the CA information into the right place.

Without this, then you could end up duplicating your CA
key into the normal directory depending on how caching
was set up.

Again, this design aspect isn't the most straightforward,
but at least it's functional now.

1 files changed, 10 insertions, 0 deletions

diff --git a/spec/integration/ssl/host.rb b/spec/integration/ssl/host.rb
index 63d7aca5b..e8fd89364 100755
--- a/spec/integration/ssl/host.rb
+++ b/spec/integration/ssl/host.rb
@@ -67,4 +67,14 @@ describe Puppet::SSL::Host do
             File.read(File.join(Puppet.settings[:requestdir], "luke.madstop.com.pem")).should == @host.certificate_request.to_s
         end
     end
+
+    describe "when the CA host" do
+        it "should never store its key in the :privatekeydir" do
+            Puppet.settings.use(:main, :ssl, :ca)
+            @ca = Puppet::SSL::Host.new(Puppet::SSL::Host.ca_name)
+            @ca.generate_key
+
+            FileTest.should_not be_exist(File.join(Puppet[:privatekeydir], "ca.pem"))
+        end
+    end
 end