diff --git a/lib/puppet/network/http/connection.rb b/lib/puppet/network/http/connection.rb
index c7d751f98..8ca35e0bd 100644
--- a/lib/puppet/network/http/connection.rb
+++ b/lib/puppet/network/http/connection.rb
@@ -1,258 +1,253 @@
 require 'net/https'
 require 'puppet/ssl/host'
 require 'puppet/ssl/configuration'
 require 'puppet/ssl/validator'
 require 'puppet/network/authentication'
 require 'puppet/network/http'
 require 'uri'
 
 module Puppet::Network::HTTP
 
   # This will be raised if too many redirects happen for a given HTTP request
   class RedirectionLimitExceededException < Puppet::Error ; end
 
   # This class provides simple methods for issuing various types of HTTP
   # requests.  It's interface is intended to mirror Ruby's Net::HTTP
   # object, but it provides a few important bits of additional
   # functionality.  Notably:
   #
   # * Any HTTPS requests made using this class will use Puppet's SSL
   #   certificate configuration for their authentication, and
   # * Provides some useful error handling for any SSL errors that occur
   #   during a request.
   # @api public
   class Connection
     include Puppet::Network::Authentication
 
     OPTION_DEFAULTS = {
       :use_ssl => true,
       :verify => nil,
       :redirect_limit => 10,
     }
 
     # Creates a new HTTP client connection to `host`:`port`.
     # @param host [String] the host to which this client will connect to
     # @param port [Fixnum] the port to which this client will connect to
     # @param options [Hash] options influencing the properties of the created
     #   connection,
     # @option options [Boolean] :use_ssl true to connect with SSL, false
     #   otherwise, defaults to true
     # @option options [#setup_connection] :verify An object that will configure
     #   any verification to do on the connection
     # @option options [Fixnum] :redirect_limit the number of allowed
     #   redirections, defaults to 10 passing any other option in the options
     #   hash results in a Puppet::Error exception
     #
     # @note the HTTP connection itself happens lazily only when {#request}, or
     #   one of the {#get}, {#post}, {#delete}, {#head} or {#put} is called
     # @note The correct way to obtain a connection is to use one of the factory
     #   methods on {Puppet::Network::HttpPool}
     # @api private
     def initialize(host, port, options = {})
       @host = host
       @port = port
 
       unknown_options = options.keys - OPTION_DEFAULTS.keys
       raise Puppet::Error, "Unrecognized option(s): #{unknown_options.map(&:inspect).sort.join(', ')}" unless unknown_options.empty?
 
       options = OPTION_DEFAULTS.merge(options)
       @use_ssl = options[:use_ssl]
       @verify = options[:verify]
       @redirect_limit = options[:redirect_limit]
       @site = Puppet::Network::HTTP::Site.new(@use_ssl ? 'https' : 'http', host, port)
       @pool = Puppet.lookup(:http_pool)
     end
 
     # @!macro [new] common_options
     #   @param options [Hash] options influencing the request made
     #   @option options [Hash{Symbol => String}] :basic_auth The basic auth
     #     :username and :password to use for the request
 
     # @param path [String]
     # @param headers [Hash{String => String}]
     # @!macro common_options
     # @api public
     def get(path, headers = {}, options = {})
       request_with_redirects(Net::HTTP::Get.new(path, headers), options)
     end
 
     # @param path [String]
     # @param data [String]
     # @param headers [Hash{String => String}]
     # @!macro common_options
     # @api public
     def post(path, data, headers = nil, options = {})
       request = Net::HTTP::Post.new(path, headers)
       request.body = data
       request_with_redirects(request, options)
     end
 
     # @param path [String]
     # @param headers [Hash{String => String}]
     # @!macro common_options
     # @api public
     def head(path, headers = {}, options = {})
       request_with_redirects(Net::HTTP::Head.new(path, headers), options)
     end
 
     # @param path [String]
     # @param headers [Hash{String => String}]
     # @!macro common_options
     # @api public
     def delete(path, headers = {'Depth' => 'Infinity'}, options = {})
       request_with_redirects(Net::HTTP::Delete.new(path, headers), options)
     end
 
     # @param path [String]
     # @param data [String]
     # @param headers [Hash{String => String}]
     # @!macro common_options
     # @api public
     def put(path, data, headers = nil, options = {})
       request = Net::HTTP::Put.new(path, headers)
       request.body = data
       request_with_redirects(request, options)
     end
 
     def request(method, *args)
       self.send(method, *args)
     end
 
     # TODO: These are proxies for the Net::HTTP#request_* methods, which are
     # almost the same as the "get", "post", etc. methods that we've ported above,
     # but they are able to accept a code block and will yield to it, which is
     # necessary to stream responses, e.g. file content.  For now
     # we're not funneling these proxy implementations through our #request
     # method above, so they will not inherit the same error handling.  In the
     # future we may want to refactor these so that they are funneled through
     # that method and do inherit the error handling.
     def request_get(*args, &block)
       with_connection(@site) do |connection|
         connection.request_get(*args, &block)
       end
     end
 
     def request_head(*args, &block)
       with_connection(@site) do |connection|
         connection.request_head(*args, &block)
       end
     end
 
     def request_post(*args, &block)
       with_connection(@site) do |connection|
         connection.request_post(*args, &block)
       end
     end
     # end of Net::HTTP#request_* proxies
 
     def address
       @site.host
     end
 
     def port
       @site.port
     end
 
     def use_ssl?
       @site.use_ssl?
     end
 
     def site
       @site
     end
 
     def initialize_ssl(http)
       @verify.setup_connection(http)
     end
 
     private
 
     def request_with_redirects(request, options)
       current_request = request
       current_site = @site
       response = nil
 
       @redirect_limit.times do |redirection|
         return response if response
 
         with_connection(current_site) do |connection|
           apply_options_to(current_request, options)
 
           current_response = execute_request(connection, current_request)
 
           if [301, 302, 307].include?(current_response.code.to_i)
 
             # handle the redirection
             location = URI.parse(current_response['location'])
             current_site = current_site.move_to(location)
 
             # update to the current request path
             current_request = current_request.class.new(location.path)
             current_request.body = request.body
             request.each do |header, value|
               current_request[header] = value
             end
           else
             response = current_response
 
             # We used to overwrite the @connection variable during
             # each redirect related request. This has the side effect
             # of changing the host & port for this connection. That
             # makes sense for 301 Moved Permanently, but not 302 Temporary
             # or 307 Temporary Redirect, as we should preserve our
             # original site for future requests...
             @site = current_site
           end
         end
 
         # and try again...
       end
 
       raise RedirectionLimitExceededException, "Too many HTTP redirections for #{@host}:#{@port}"
     end
 
     def apply_options_to(request, options)
       if options[:basic_auth]
         request.basic_auth(options[:basic_auth][:user], options[:basic_auth][:password])
       end
     end
 
-    def connection
-      factory = Puppet::Network::HTTP::Factory.new
-      factory.create_connection(@site)
-    end
-
     def execute_request(connection, request)
       response = connection.request(request)
 
       # Check the peer certs and warn if they're nearing expiration.
       warn_if_near_expiration(*@verify.peer_certs)
 
       response
     rescue OpenSSL::SSL::SSLError => error
       if error.message.include? "certificate verify failed"
         msg = error.message
         msg << ": [" + @verify.verify_errors.join('; ') + "]"
         raise Puppet::Error, msg, error.backtrace
       elsif error.message =~ /hostname.*not match.*server certificate/
         leaf_ssl_cert = @verify.peer_certs.last
 
         valid_certnames = [leaf_ssl_cert.name, *leaf_ssl_cert.subject_alt_names].uniq
         msg = valid_certnames.length > 1 ? "one of #{valid_certnames.join(', ')}" : valid_certnames.first
         msg = "Server hostname '#{connection.address}' did not match server certificate; expected #{msg}"
 
         raise Puppet::Error, msg, error.backtrace
       else
         raise
       end
     end
 
     def with_connection(site, &block)
       response = nil
       @pool.with_connection(self) do |conn|
         response = yield conn
       end
       response
     end
   end
 end
diff --git a/spec/unit/network/http/connection_spec.rb b/spec/unit/network/http/connection_spec.rb
index fa17a5c14..b217cf12e 100755
--- a/spec/unit/network/http/connection_spec.rb
+++ b/spec/unit/network/http/connection_spec.rb
@@ -1,267 +1,251 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
 require 'puppet/network/http/connection'
 require 'puppet/network/authentication'
 
 describe Puppet::Network::HTTP::Connection do
 
   let (:host) { "me" }
   let (:port) { 54321 }
   subject { Puppet::Network::HTTP::Connection.new(host, port, :verify => Puppet::SSL::Validator.no_validator) }
   let (:httpok) { Net::HTTPOK.new('1.1', 200, '') }
 
   context "when providing HTTP connections" do
     context "when initializing http instances" do
-      before :each do
-        # All of the cert stuff is tested elsewhere
-        Puppet::Network::HTTP::Connection.stubs(:initialize_ssl)
-      end
-
       it "should return an http instance created with the passed host and port" do
-        http = subject.send(:connection)
-        http.should be_an_instance_of Net::HTTP
-        http.address.should == host
-        http.port.should    == port
+        conn = Puppet::Network::HTTP::Connection.new(host, port, :verify => Puppet::SSL::Validator.no_validator)
+
+        expect(conn.address).to eq(host)
+        expect(conn.port).to eq(port)
       end
 
       it "should enable ssl on the http instance by default" do
-        http = subject.send(:connection)
-        http.should be_use_ssl
-      end
+        conn = Puppet::Network::HTTP::Connection.new(host, port, :verify => Puppet::SSL::Validator.no_validator)
 
-      it "can set ssl using an option" do
-        Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => false, :verify => Puppet::SSL::Validator.no_validator).send(:connection).should_not be_use_ssl
-        Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => true, :verify => Puppet::SSL::Validator.no_validator).send(:connection).should be_use_ssl
+        expect(conn).to be_use_ssl
       end
 
-      context "proxy and timeout settings should propagate" do
-        subject { Puppet::Network::HTTP::Connection.new(host, port, :verify => Puppet::SSL::Validator.no_validator).send(:connection) }
-        before :each do
-          Puppet[:http_proxy_host] = "myhost"
-          Puppet[:http_proxy_port] = 432
-          Puppet[:configtimeout]   = 120
-        end
+      it "can disable ssl using an option" do
+        conn = Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => false, :verify => Puppet::SSL::Validator.no_validator)
 
-        its(:open_timeout)  { should == Puppet[:configtimeout] }
-        its(:read_timeout)  { should == Puppet[:configtimeout] }
-        its(:proxy_address) { should == Puppet[:http_proxy_host] }
-        its(:proxy_port)    { should == Puppet[:http_proxy_port] }
+        expect(conn).to_not be_use_ssl
       end
 
-      it "should not set a proxy if the value is 'none'" do
-        Puppet[:http_proxy_host] = 'none'
-        subject.send(:connection).proxy_address.should be_nil
+      it "can enable ssl using an option" do
+        conn = Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => true, :verify => Puppet::SSL::Validator.no_validator)
+
+        expect(conn).to be_use_ssl
       end
 
       it "should raise Puppet::Error when invalid options are specified" do
         expect { Puppet::Network::HTTP::Connection.new(host, port, :invalid_option => nil) }.to raise_error(Puppet::Error, 'Unrecognized option(s): :invalid_option')
       end
     end
   end
 
   context "when methods that accept a block are called with a block" do
     let (:host) { "my_server" }
     let (:port) { 8140 }
     let (:subject) { Puppet::Network::HTTP::Connection.new(host, port, :use_ssl => false, :verify => Puppet::SSL::Validator.no_validator) }
 
     before :each do
       httpok.stubs(:body).returns ""
 
       # This stubbing relies a bit more on knowledge of the internals of Net::HTTP
       # than I would prefer, but it works on ruby 1.8.7 and 1.9.3, and it seems
       # valuable enough to have tests for blocks that this is probably warranted.
       socket = stub_everything("socket")
       TCPSocket.stubs(:open).returns(socket)
 
       Net::HTTP::Post.any_instance.stubs(:exec).returns("")
       Net::HTTP::Head.any_instance.stubs(:exec).returns("")
       Net::HTTP::Get.any_instance.stubs(:exec).returns("")
       Net::HTTPResponse.stubs(:read_new).returns(httpok)
     end
 
     [:request_get, :request_head, :request_post].each do |method|
       context "##{method}" do
         it "should yield to the block" do
           block_executed = false
           subject.send(method, "/foo", {}) do |response|
             block_executed = true
           end
           block_executed.should == true
         end
       end
     end
   end
 
   context "when validating HTTPS requests" do
     include PuppetSpec::Files
 
     let (:host) { "my_server" }
     let (:port) { 8140 }
 
     it "should provide a useful error message when one is available and certificate validation fails", :unless => Puppet.features.microsoft_windows? do
       connection = Puppet::Network::HTTP::Connection.new(
         host, port,
         :verify => ConstantErrorValidator.new(:fails_with => 'certificate verify failed',
                                               :error_string => 'shady looking signature'))
 
       expect do
         connection.get('request')
       end.to raise_error(Puppet::Error, "certificate verify failed: [shady looking signature]")
     end
 
     it "should provide a helpful error message when hostname was not match with server certificate", :unless => Puppet.features.microsoft_windows? do
       Puppet[:confdir] = tmpdir('conf')
 
       connection = Puppet::Network::HTTP::Connection.new(
         host, port,
         :verify => ConstantErrorValidator.new(
           :fails_with => 'hostname was not match with server certificate',
           :peer_certs => [Puppet::SSL::CertificateAuthority.new.generate(
             'not_my_server', :dns_alt_names => 'foo,bar,baz')]))
 
       expect do
         connection.get('request')
       end.to raise_error(Puppet::Error) do |error|
         error.message =~ /Server hostname 'my_server' did not match server certificate; expected one of (.+)/
         $1.split(', ').should =~ %w[DNS:foo DNS:bar DNS:baz DNS:not_my_server not_my_server]
       end
     end
 
     it "should pass along the error message otherwise" do
       connection = Puppet::Network::HTTP::Connection.new(
         host, port,
         :verify => ConstantErrorValidator.new(:fails_with => 'some other message'))
 
       expect do
         connection.get('request')
       end.to raise_error(/some other message/)
     end
 
     it "should check all peer certificates for upcoming expiration", :unless => Puppet.features.microsoft_windows? do
       Puppet[:confdir] = tmpdir('conf')
       cert = Puppet::SSL::CertificateAuthority.new.generate(
         'server', :dns_alt_names => 'foo,bar,baz')
 
       connection = Puppet::Network::HTTP::Connection.new(
         host, port,
         :verify => NoProblemsValidator.new(cert))
 
       Net::HTTP.any_instance.stubs(:request).returns(httpok)
 
       connection.expects(:warn_if_near_expiration).with(cert)
 
       connection.get('request')
     end
 
     class ConstantErrorValidator
       def initialize(args)
         @fails_with = args[:fails_with]
         @error_string = args[:error_string] || ""
         @peer_certs = args[:peer_certs] || []
       end
 
       def setup_connection(connection)
         connection.stubs(:request).with do
           true
         end.raises(OpenSSL::SSL::SSLError.new(@fails_with))
       end
 
       def peer_certs
         @peer_certs
       end
 
       def verify_errors
         [@error_string]
       end
     end
 
     class NoProblemsValidator
       def initialize(cert)
         @cert = cert
       end
 
       def setup_connection(connection)
       end
 
       def peer_certs
         [@cert]
       end
 
       def verify_errors
         []
       end
     end
   end
 
   context "when response is a redirect" do
     let (:other_host) { "redirected" }
     let (:other_port) { 9292 }
     let (:other_path) { "other-path" }
     let (:subject) { Puppet::Network::HTTP::Connection.new("my_server", 8140, :use_ssl => false, :verify => Puppet::SSL::Validator.no_validator) }
     let (:httpredirection) { Net::HTTPFound.new('1.1', 302, 'Moved Temporarily') }
 
     before :each do
       httpredirection['location'] = "http://#{other_host}:#{other_port}/#{other_path}"
       httpredirection.stubs(:read_body).returns("This resource has moved")
 
       socket = stub_everything("socket")
       TCPSocket.stubs(:open).returns(socket)
 
       Net::HTTP::Get.any_instance.stubs(:exec).returns("")
       Net::HTTP::Post.any_instance.stubs(:exec).returns("")
     end
 
     it "should redirect to the final resource location" do
       httpok.stubs(:read_body).returns(:body)
       Net::HTTPResponse.stubs(:read_new).returns(httpredirection).then.returns(httpok)
 
       subject.get("/foo").body.should == :body
       subject.port.should == other_port
       subject.address.should == other_host
     end
 
     it "should raise an error after too many redirections" do
       Net::HTTPResponse.stubs(:read_new).returns(httpredirection)
 
       expect {
         subject.get("/foo")
       }.to raise_error(Puppet::Network::HTTP::RedirectionLimitExceededException)
     end
   end
 
   it "allows setting basic auth on get requests" do
     expect_request_with_basic_auth
 
     subject.get('/path', nil, :basic_auth => { :user => 'user', :password => 'password' })
   end
 
   it "allows setting basic auth on post requests" do
     expect_request_with_basic_auth
 
     subject.post('/path', 'data', nil, :basic_auth => { :user => 'user', :password => 'password' })
   end
 
   it "allows setting basic auth on head requests" do
     expect_request_with_basic_auth
 
     subject.head('/path', nil, :basic_auth => { :user => 'user', :password => 'password' })
   end
 
   it "allows setting basic auth on delete requests" do
     expect_request_with_basic_auth
 
     subject.delete('/path', nil, :basic_auth => { :user => 'user', :password => 'password' })
   end
 
   it "allows setting basic auth on put requests" do
     expect_request_with_basic_auth
 
     subject.put('/path', 'data', nil, :basic_auth => { :user => 'user', :password => 'password' })
   end
 
   def expect_request_with_basic_auth
     Net::HTTP.any_instance.expects(:request).with do |request|
       expect(request['authorization']).to match(/^Basic/)
     end.returns(httpok)
   end
 end
diff --git a/spec/unit/network/http/factory_spec.rb b/spec/unit/network/http/factory_spec.rb
index ec004b80f..107ededcd 100755
--- a/spec/unit/network/http/factory_spec.rb
+++ b/spec/unit/network/http/factory_spec.rb
@@ -1,37 +1,82 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
 require 'puppet/network/http'
 
 describe Puppet::Network::HTTP::Factory do
   before :each do
     Puppet::SSL::Key.indirection.terminus_class = :memory
     Puppet::SSL::CertificateRequest.indirection.terminus_class = :memory
   end
 
   let(:site) { Puppet::Network::HTTP::Site.new('https', 'www.example.com', 443) }
   def create_connection(site)
     factory = Puppet::Network::HTTP::Factory.new
 
     factory.create_connection(site)
   end
 
   it 'creates a connection for the site' do
     conn = create_connection(site)
 
     expect(conn.use_ssl?).to be_true
     expect(conn.address).to eq(site.host)
     expect(conn.port).to eq(site.port)
   end
 
   it 'creates a connection that has not yet been started' do
     conn = create_connection(site)
 
     expect(conn).to_not be_started
   end
 
   it 'creates a connection supporting at least HTTP 1.1' do
     conn = create_connection(site)
 
     expect(any_of(conn.class.version_1_1?, conn.class.version_1_1?)).to be_true
   end
+
+  context "proxy settings" do
+    let(:proxy_host) { 'myhost' }
+    let(:proxy_port) { 432 }
+
+    it "should not set a proxy if the value is 'none'" do
+      Puppet[:http_proxy_host] = 'none'
+      conn = create_connection(site)
+
+      expect(conn.proxy_address).to be_nil
+    end
+
+    it 'sets proxy_address' do
+      Puppet[:http_proxy_host] = proxy_host
+      conn = create_connection(site)
+
+      expect(conn.proxy_address).to eq(proxy_host)
+    end
+
+    it 'sets proxy address and port' do
+      Puppet[:http_proxy_host] = proxy_host
+      Puppet[:http_proxy_port] = proxy_port
+      conn = create_connection(site)
+
+      expect(conn.proxy_port).to eq(proxy_port)
+    end
+
+    context 'socket timeouts' do
+      let(:timeout) { 5 }
+
+      it 'sets open timeout' do
+        Puppet[:configtimeout] = timeout
+        conn = create_connection(site)
+
+        expect(conn.open_timeout).to eq(timeout)
+      end
+
+      it 'sets read timeout' do
+        Puppet[:configtimeout] = timeout
+        conn = create_connection(site)
+
+        expect(conn.read_timeout).to eq(timeout)
+      end
+    end
+  end
 end