diff --git a/lib/puppet/ssl/certificate_authority.rb b/lib/puppet/ssl/certificate_authority.rb
index a453f0fb9..179acd998 100644
--- a/lib/puppet/ssl/certificate_authority.rb
+++ b/lib/puppet/ssl/certificate_authority.rb
@@ -1,362 +1,362 @@
 require 'monitor'
 require 'puppet/ssl/host'
 require 'puppet/ssl/certificate_request'
 
 # The class that knows how to sign certificates.  It creates
 # a 'special' SSL::Host whose name is 'ca', thus indicating
 # that, well, it's the CA.  There's some magic in the
 # indirector/ssl_file terminus base class that does that
 # for us.
 #   This class mostly just signs certs for us, but
 # it can also be seen as a general interface into all of the
 # SSL stuff.
 class Puppet::SSL::CertificateAuthority
   # We will only sign extensions on this whitelist, ever.  Any CSR with a
   # requested extension that we don't recognize is rejected, against the risk
   # that it will introduce some security issue through our ignorance of it.
   #
   # Adding an extension to this whitelist simply means we will consider it
   # further, not that we will always accept a certificate with an extension
   # requested on this list.
   RequestExtensionWhitelist = %w{subjectAltName}
 
   require 'puppet/ssl/certificate_factory'
   require 'puppet/ssl/inventory'
   require 'puppet/ssl/certificate_revocation_list'
   require 'puppet/ssl/certificate_authority/interface'
   require 'puppet/network/authstore'
 
   extend MonitorMixin
 
   class CertificateVerificationError < RuntimeError
     attr_accessor :error_code
 
     def initialize(code)
       @error_code = code
     end
   end
 
   def self.singleton_instance
     synchronize do
       @singleton_instance ||= new
     end
   end
 
   class CertificateSigningError < RuntimeError
     attr_accessor :host
 
     def initialize(host)
       @host = host
     end
   end
 
   def self.ca?
     return false unless Puppet[:ca]
     return false unless Puppet.run_mode.master?
     true
   end
 
   # If this process can function as a CA, then return a singleton
   # instance.
   def self.instance
     return nil unless ca?
 
     singleton_instance
   end
 
   attr_reader :name, :host
 
   # Create and run an applicator.  I wanted to build an interface where you could do
   # something like 'ca.apply(:generate).to(:all) but I don't think it's really possible.
   def apply(method, options)
     raise ArgumentError, "You must specify the hosts to apply to; valid values are an array or the symbol :all" unless options[:to]
     applier = Interface.new(method, options)
     applier.apply(self)
   end
 
   # If autosign is configured, then autosign all CSRs that match our configuration.
   def autosign
     return unless auto = autosign?
 
     store = nil
     store = autosign_store(auto) if auto != true
 
     Puppet::SSL::CertificateRequest.indirection.search("*").each do |csr|
       sign(csr.name) if auto == true or store.allowed?(csr.name, "127.1.1.1")
     end
   end
 
   # Do we autosign?  This returns true, false, or a filename.
   def autosign?
     auto = Puppet[:autosign]
     return false if ['false', false].include?(auto)
     return true if ['true', true].include?(auto)
 
     raise ArgumentError, "The autosign configuration '#{auto}' must be a fully qualified file" unless auto =~ /^\//
     FileTest.exist?(auto) && auto
   end
 
   # Create an AuthStore for autosigning.
   def autosign_store(file)
     auth = Puppet::Network::AuthStore.new
     File.readlines(file).each do |line|
       next if line =~ /^\s*#/
       next if line =~ /^\s*$/
       auth.allow(line.chomp)
     end
 
     auth
   end
 
   # Retrieve (or create, if necessary) the certificate revocation list.
   def crl
     unless defined?(@crl)
       unless @crl = Puppet::SSL::CertificateRevocationList.indirection.find(Puppet::SSL::CA_NAME)
         @crl = Puppet::SSL::CertificateRevocationList.new(Puppet::SSL::CA_NAME)
         @crl.generate(host.certificate.content, host.key.content)
         Puppet::SSL::CertificateRevocationList.indirection.save(@crl)
       end
     end
     @crl
   end
 
   # Delegate this to our Host class.
   def destroy(name)
     Puppet::SSL::Host.destroy(name)
   end
 
   # Generate a new certificate.
   def generate(name, options = {})
     raise ArgumentError, "A Certificate already exists for #{name}" if Puppet::SSL::Certificate.indirection.find(name)
     host = Puppet::SSL::Host.new(name)
 
     # Pass on any requested subjectAltName field.
     san = options[:dns_alt_names]
 
     host = Puppet::SSL::Host.new(name)
     host.generate_certificate_request(:dns_alt_names => san)
     sign(name, !!san)
   end
 
   # Generate our CA certificate.
   def generate_ca_certificate
     generate_password unless password?
 
     host.generate_key unless host.key
 
     # Create a new cert request.  We do this specially, because we don't want
     # to actually save the request anywhere.
     request = Puppet::SSL::CertificateRequest.new(host.name)
 
     # We deliberately do not put any subjectAltName in here: the CA
     # certificate absolutely does not need them. --daniel 2011-10-13
     request.generate(host.key)
 
     # Create a self-signed certificate.
     @certificate = sign(host.name, false, request)
 
     # And make sure we initialize our CRL.
     crl
   end
 
   def initialize
     Puppet.settings.use :main, :ssl, :ca
 
     @name = Puppet[:certname]
 
     @host = Puppet::SSL::Host.new(Puppet::SSL::Host.ca_name)
 
     setup
   end
 
   # Retrieve (or create, if necessary) our inventory manager.
   def inventory
     @inventory ||= Puppet::SSL::Inventory.new
   end
 
   # Generate a new password for the CA.
   def generate_password
     pass = ""
     20.times { pass += (rand(74) + 48).chr }
 
     begin
       Puppet.settings.write(:capass) { |f| f.print pass }
     rescue Errno::EACCES => detail
       raise Puppet::Error, "Could not write CA password: #{detail}"
     end
 
     @password = pass
 
     pass
   end
 
   # List all signed certificates.
   def list
     Puppet::SSL::Certificate.indirection.search("*").collect { |c| c.name }
   end
 
   # Read the next serial from the serial file, and increment the
   # file so this one is considered used.
   def next_serial
     serial = nil
 
     # This is slightly odd.  If the file doesn't exist, our readwritelock creates
     # it, but with a mode we can't actually read in some cases.  So, use
     # a default before the lock.
     serial = 0x1 unless FileTest.exist?(Puppet[:serial])
 
     Puppet.settings.readwritelock(:serial) { |f|
       serial ||= File.read(Puppet.settings[:serial]).chomp.hex if FileTest.exist?(Puppet[:serial])
 
       # We store the next valid serial, not the one we just used.
       f << "%04X" % (serial + 1)
     }
 
     serial
   end
 
   # Does the password file exist?
   def password?
     FileTest.exist? Puppet[:capass]
   end
 
   # Print a given host's certificate as text.
   def print(name)
     (cert = Puppet::SSL::Certificate.indirection.find(name)) ? cert.to_text : nil
   end
 
   # Revoke a given certificate.
   def revoke(name)
     raise ArgumentError, "Cannot revoke certificates when the CRL is disabled" unless crl
 
     if cert = Puppet::SSL::Certificate.indirection.find(name)
       serial = cert.content.serial
     elsif ! serial = inventory.serial(name)
       raise ArgumentError, "Could not find a serial number for #{name}"
     end
     crl.revoke(serial, host.key.content)
   end
 
   # This initializes our CA so it actually works.  This should be a private
   # method, except that you can't any-instance stub private methods, which is
   # *awesome*.  This method only really exists to provide a stub-point during
   # testing.
   def setup
     generate_ca_certificate unless @host.certificate
   end
 
   # Sign a given certificate request.
   def sign(hostname, allow_dns_alt_names = false, self_signing_csr = nil)
     # This is a self-signed certificate
     if self_signing_csr
       # # This is a self-signed certificate, which is for the CA.  Since this
       # # forces the certificate to be self-signed, anyone who manages to trick
       # # the system into going through this path gets a certificate they could
       # # generate anyway.  There should be no security risk from that.
       csr = self_signing_csr
       cert_type = :ca
       issuer = csr.content
     else
       allow_dns_alt_names = true if hostname == Puppet[:certname].downcase
       unless csr = Puppet::SSL::CertificateRequest.indirection.find(hostname)
         raise ArgumentError, "Could not find certificate request for #{hostname}"
       end
 
       cert_type = :server
       issuer = host.certificate.content
 
       # Make sure that the CSR conforms to our internal signing policies.
       # This will raise if the CSR doesn't conform, but just in case...
       check_internal_signing_policies(hostname, csr, allow_dns_alt_names) or
         raise CertificateSigningError.new(hostname), "CSR had an unknown failure checking internal signing policies, will not sign!"
     end
 
     cert = Puppet::SSL::Certificate.new(hostname)
     cert.content = Puppet::SSL::CertificateFactory.
       build(cert_type, csr, issuer, next_serial)
     cert.content.sign(host.key.content, OpenSSL::Digest::SHA1.new)
 
     Puppet.notice "Signed certificate request for #{hostname}"
 
     # Add the cert to the inventory before we save it, since
     # otherwise we could end up with it being duplicated, if
     # this is the first time we build the inventory file.
     inventory.add(cert)
 
     # Save the now-signed cert.  This should get routed correctly depending
     # on the certificate type.
     Puppet::SSL::Certificate.indirection.save(cert)
 
     # And remove the CSR if this wasn't self signed.
     Puppet::SSL::CertificateRequest.indirection.destroy(csr.name) unless self_signing_csr
 
     cert
   end
 
   def check_internal_signing_policies(hostname, csr, allow_dns_alt_names)
     # Reject unknown request extensions.
     unknown_req = csr.request_extensions.
       reject {|x| RequestExtensionWhitelist.include? x["oid"] }
 
     if unknown_req and not unknown_req.empty?
       names = unknown_req.map {|x| x["oid"] }.sort.uniq.join(", ")
       raise CertificateSigningError.new(hostname), "CSR has request extensions that are not permitted: #{names}"
     end
 
     # Wildcards: we don't allow 'em at any point.
     #
     # The stringification here makes the content visible, and saves us having
     # to scrobble through the content of the CSR subject field to make sure it
     # is what we expect where we expect it.
     if csr.content.subject.to_s.include? '*'
       raise CertificateSigningError.new(hostname), "CSR subject contains a wildcard, which is not allowed: #{csr.content.subject.to_s}"
     end
 
     unless csr.subject_alt_names.empty?
       # If you alt names are allowed, they are required. Otherwise they are
       # disallowed. Self-signed certs are implicitly trusted, however.
       unless allow_dns_alt_names
-        raise CertificateSigningError.new(hostname), "CSR contained subject alternative names (#{csr.subject_alt_names.join(', ')}), which are disallowed. Use --allow-dns-alt-names to sign this request."
+        raise CertificateSigningError.new(hostname), "CSR '#{csr.name}' contains subject alternative names (#{csr.subject_alt_names.join(', ')}), which are disallowed. Use `puppet cert --allow-dns-alt-names sign #{csr.name}` to sign this request."
       end
 
       # If subjectAltNames are present, validate that they are only for DNS
       # labels, not any other kind.
       unless csr.subject_alt_names.all? {|x| x =~ /^DNS:/ }
-        raise CertificateSigningError.new(hostname), "CSR contained a subjectAltName outside the DNS label space: #{csr.subject_alt_names.join(', ')}"
+        raise CertificateSigningError.new(hostname), "CSR '#{csr.name}' contains a subjectAltName outside the DNS label space: #{csr.subject_alt_names.join(', ')}.  To continue, this CSR needs to be cleaned."
       end
 
       # Check for wildcards in the subjectAltName fields too.
       if csr.subject_alt_names.any? {|x| x.include? '*' }
-        raise CertificateSigningError.new(hostname), "CSR subjectAltName contains a wildcard, which is not allowed: #{csr.subject_alt_names.join(', ')}"
+        raise CertificateSigningError.new(hostname), "CSR '#{csr.name}' subjectAltName contains a wildcard, which is not allowed: #{csr.subject_alt_names.join(', ')}  To continue, this CSR needs to be cleaned."
       end
     end
 
     return true                 # good enough for us!
   end
 
   # Verify a given host's certificate.
   def verify(name)
     unless cert = Puppet::SSL::Certificate.indirection.find(name)
       raise ArgumentError, "Could not find a certificate for #{name}"
     end
     store = OpenSSL::X509::Store.new
     store.add_file Puppet[:cacert]
     store.add_crl crl.content if self.crl
     store.purpose = OpenSSL::X509::PURPOSE_SSL_CLIENT
     store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK if Puppet.settings[:certificate_revocation]
 
     raise CertificateVerificationError.new(store.error), store.error_string unless store.verify(cert.content)
   end
 
   def fingerprint(name, md = :MD5)
     unless cert = Puppet::SSL::Certificate.indirection.find(name) || Puppet::SSL::CertificateRequest.indirection.find(name)
       raise ArgumentError, "Could not find a certificate or csr for #{name}"
     end
     cert.fingerprint(md)
   end
 
   # List the waiting certificate requests.
   def waiting?
     Puppet::SSL::CertificateRequest.indirection.search("*").collect { |r| r.name }
   end
 end
diff --git a/spec/unit/face/ca_spec.rb b/spec/unit/face/ca_spec.rb
index 445c91ecc..018942e81 100755
--- a/spec/unit/face/ca_spec.rb
+++ b/spec/unit/face/ca_spec.rb
@@ -1,388 +1,389 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 require 'puppet/face'
 
 describe Puppet::Face[:ca, '0.1.0'], :unless => Puppet.features.microsoft_windows? do
   include PuppetSpec::Files
 
   before :each do
     Puppet.run_mode.stubs(:master?).returns(true)
     Puppet[:ca]     = true
     Puppet[:ssldir] = tmpdir("face-ca-ssldir")
 
     Puppet::SSL::Host.ca_location = :only
     Puppet[:certificate_revocation] = true
 
     # This is way more intimate than I want to be with the implementation, but
     # there doesn't seem any other way to test this. --daniel 2011-07-18
     Puppet::SSL::CertificateAuthority.stubs(:instance).returns(
         # ...and this actually does the directory creation, etc.
         Puppet::SSL::CertificateAuthority.new
     )
   end
 
   def make_certs(csr_names, crt_names)
     Array(csr_names).map do |name|
       Puppet::SSL::Host.new(name).generate_certificate_request
     end
 
     Array(crt_names).map do |name|
       Puppet::SSL::Host.new(name).generate
     end
   end
 
   context "#verify" do
     let :action do Puppet::Face[:ca, '0.1.0'].get_action(:verify) end
 
     it "should not explode if there is no certificate" do
       expect {
         subject.verify('random-host').should == {
           :host => 'random-host', :valid => false,
           :error => 'Could not find a certificate for random-host'
         }
       }.should_not raise_error
     end
 
     it "should not explode if there is only a CSR" do
       make_certs('random-host', [])
       expect {
         subject.verify('random-host').should == {
           :host => 'random-host', :valid => false,
           :error => 'Could not find a certificate for random-host'
         }
       }.should_not raise_error
     end
 
     it "should verify a signed certificate" do
       make_certs([], 'random-host')
       subject.verify('random-host').should == {
         :host => 'random-host', :valid => true
       }
     end
 
     it "should not verify a revoked certificate" do
       make_certs([], 'random-host')
       subject.revoke('random-host')
 
       expect {
         subject.verify('random-host').should == {
           :host => 'random-host', :valid => false,
           :error => 'certificate revoked'
         }
       }.should_not raise_error
     end
 
     it "should verify a revoked certificate if CRL use was turned off" do
       make_certs([], 'random-host')
       subject.revoke('random-host')
 
       Puppet[:certificate_revocation] = false
       subject.verify('random-host').should == {
         :host => 'random-host', :valid => true
       }
     end
   end
 
   context "#fingerprint" do
     let :action do Puppet::Face[:ca, '0.1.0'].get_action(:fingerprint) end
 
     it "should have a 'digest' option" do
       action.should be_option :digest
     end
 
     it "should not explode if there is no certificate" do
       expect {
         subject.fingerprint('random-host').should be_nil
       }.should_not raise_error
     end
 
     it "should fingerprint a CSR" do
       make_certs('random-host', [])
       expect {
         subject.fingerprint('random-host').should =~ /^[0-9A-F:]+$/
       }.should_not raise_error
     end
 
     it "should fingerprint a certificate" do
       make_certs([], 'random-host')
       subject.fingerprint('random-host').should =~ /^[0-9A-F:]+$/
     end
 
     %w{md5 MD5 sha1 ShA1 SHA1 RIPEMD160 sha256 sha512}.each do |digest|
       it "should fingerprint with #{digest.inspect}" do
         make_certs([], 'random-host')
         subject.fingerprint('random-host', :digest => digest).should =~ /^[0-9A-F:]+$/
       end
 
       it "should fingerprint with #{digest.to_sym} as a symbol" do
         make_certs([], 'random-host')
         subject.fingerprint('random-host', :digest => digest.to_sym).
           should =~ /^[0-9A-F:]+$/
       end
     end
   end
 
   context "#print" do
     let :action do Puppet::Face[:ca, '0.1.0'].get_action(:print) end
 
     it "should not explode if there is no certificate" do
       expect {
         subject.print('random-host').should be_nil
       }.should_not raise_error
     end
 
     it "should return nothing if there is only a CSR" do
       make_certs('random-host', [])
       expect {
         subject.print('random-host').should be_nil
       }.should_not raise_error
     end
 
     it "should return the certificate content if there is a cert" do
       make_certs([], 'random-host')
       text = subject.print('random-host')
       text.should be_an_instance_of String
       text.should =~ /^Certificate:/
       text.should =~ /Issuer: CN=Puppet CA: /
       text.should =~ /Subject: CN=random-host$/
     end
   end
 
   context "#sign" do
     let :action do Puppet::Face[:ca, '0.1.0'].get_action(:sign) end
 
     it "should not explode if there is no CSR" do
       expect {
         subject.sign('random-host').
           should == 'Could not find certificate request for random-host'
       }.should_not raise_error
     end
 
     it "should not explode if there is a signed cert" do
       make_certs([], 'random-host')
       expect {
         subject.sign('random-host').
           should == 'Could not find certificate request for random-host'
       }.should_not raise_error
     end
 
     it "should sign a CSR if one exists" do
       make_certs('random-host', [])
       subject.sign('random-host').should be_an_instance_of Puppet::SSL::Certificate
 
       list = subject.list(:signed => true)
       list.length.should == 1
       list.first.name.should == 'random-host'
     end
 
     describe "when the CSR specifies DNS alt names" do
       let(:host) { Puppet::SSL::Host.new('someone') }
 
       before :each do
         host.generate_certificate_request(:dns_alt_names => 'some,alt,names')
       end
 
       it "should sign the CSR if DNS alt names are allowed" do
         subject.sign('someone', :allow_dns_alt_names => true)
 
         host.certificate.should be_a(Puppet::SSL::Certificate)
       end
 
       it "should refuse to sign the CSR if DNS alt names are not allowed" do
+        certname = 'someone'
         expect do
-          subject.sign('someone')
-        end.to raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError, /CSR contained subject alternative names (.*), which are disallowed./)
+          subject.sign(certname)
+        end.to raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError, /CSR '#{certname}' contains subject alternative names \(.*\), which are disallowed. Use `puppet cert --allow-dns-alt-names sign #{certname}` to sign this request./i)
 
         host.certificate.should be_nil
       end
     end
   end
 
   context "#generate" do
     let :action do Puppet::Face[:ca, '0.1.0'].get_action(:generate) end
 
     it "should generate a certificate if requested" do
       subject.list(:all => true).should == []
 
       subject.generate('random-host')
 
       list = subject.list(:signed => true)
       list.length.should == 1
       list.first.name.should == 'random-host'
     end
 
     it "should not explode if a CSR with that name already exists" do
       make_certs('random-host', [])
       expect {
         subject.generate('random-host').should =~ /already has a certificate request/
       }.should_not raise_error
     end
 
     it "should not explode if the certificate with that name already exists" do
       make_certs([], 'random-host')
       expect {
         subject.generate('random-host').should =~ /already has a certificate/
       }.should_not raise_error
     end
 
     it "should include the specified DNS alt names" do
       subject.generate('some-host', :dns_alt_names => 'some,alt,names')
 
       host = subject.list(:signed => true).first
 
       host.name.should == 'some-host'
       host.certificate.subject_alt_names.should =~ %w[DNS:some DNS:alt DNS:names DNS:some-host]
 
       subject.list(:pending => true).should be_empty
     end
   end
 
   context "#revoke" do
     let :action do Puppet::Face[:ca, '0.1.0'].get_action(:revoke) end
 
     it "should not explode when asked to revoke something that doesn't exist" do
       expect { subject.revoke('nonesuch') }.should_not raise_error
     end
 
     it "should let the user know what went wrong" do
       subject.revoke('nonesuch').should == 'Nothing was revoked'
     end
 
     it "should revoke a certificate" do
       make_certs([], 'random-host')
       found = subject.list(:all => true, :subject => 'random-host')
       subject.get_action(:list).when_rendering(:console).call(found).
         should =~ /^\+ random-host/
 
       subject.revoke('random-host')
 
       found = subject.list(:all => true, :subject => 'random-host')
       subject.get_action(:list).when_rendering(:console).call(found).
         should =~ /^- random-host  \([:0-9A-F]+\) \(certificate revoked\)/
     end
   end
 
   context "#destroy" do
     let :action do Puppet::Face[:ca, '0.1.0'].get_action(:destroy) end
 
     it "should not explode when asked to delete something that doesn't exist" do
       expect { subject.destroy('nonesuch') }.should_not raise_error
     end
 
     it "should let the user know if nothing was deleted" do
       subject.destroy('nonesuch').should == "Nothing was deleted"
     end
 
     it "should destroy a CSR, if we have one" do
       make_certs('random-host', [])
       subject.list(:pending => true, :subject => 'random-host').should_not == []
 
       subject.destroy('random-host')
 
       subject.list(:pending => true, :subject => 'random-host').should == []
     end
 
     it "should destroy a certificate, if we have one" do
       make_certs([], 'random-host')
       subject.list(:signed => true, :subject => 'random-host').should_not == []
 
       subject.destroy('random-host')
 
       subject.list(:signed => true, :subject => 'random-host').should == []
     end
 
     it "should tell the user something was deleted" do
       make_certs([], 'random-host')
       subject.list(:signed => true, :subject => 'random-host').should_not == []
       subject.destroy('random-host').
         should == "Deleted for random-host: Puppet::SSL::Certificate, Puppet::SSL::Key"
     end
   end
 
   context "#list" do
     let :action do Puppet::Face[:ca, '0.1.0'].get_action(:list) end
 
     context "options" do
       subject { Puppet::Face[:ca, '0.1.0'].get_action(:list) }
       it { should be_option :pending }
       it { should be_option :signed  }
       it { should be_option :all     }
       it { should be_option :subject }
     end
 
     context "with no hosts in CA" do
       [:pending, :signed, :all].each do |type|
         it "should return nothing for #{type}" do
           subject.list(type => true).should == []
         end
 
         it "should not fail when a matcher is passed" do
           expect {
             subject.list(type => true, :subject => '.').should == []
           }.should_not raise_error
         end
       end
     end
 
     context "with some hosts" do
       csr_names = (1..3).map {|n| "csr-#{n}" }
       crt_names = (1..3).map {|n| "crt-#{n}" }
       all_names = csr_names + crt_names
 
       {
         {}                                    => csr_names,
         { :pending => true                  } => csr_names,
 
         { :signed  => true                  } => crt_names,
 
         { :all     => true                  } => all_names,
         { :pending => true, :signed => true } => all_names,
       }.each do |input, expect|
         it "should map #{input.inspect} to #{expect.inspect}" do
           make_certs(csr_names, crt_names)
           subject.list(input).map(&:name).should =~ expect
         end
 
         ['', '.', '2', 'none'].each do |pattern|
           filtered = expect.select {|x| Regexp.new(pattern).match(x) }
 
           it "should filter all hosts matching #{pattern.inspect} to #{filtered.inspect}" do
             make_certs(csr_names, crt_names)
             subject.list(input.merge :subject => pattern).map(&:name).should =~ filtered
           end
         end
       end
 
       context "when_rendering :console" do
         { [["csr1.local"], []] => '^  csr1.local ',
           [[], ["crt1.local"]] => '^\+ crt1.local ',
           [["csr2"], ["crt2"]] => ['^  csr2 ', '^\+ crt2 ']
         }.each do |input, pattern|
           it "should render #{input.inspect} to match #{pattern.inspect}" do
             make_certs(*input)
             text = action.when_rendering(:console).call(subject.list(:all => true))
             Array(pattern).each do |item|
               text.should =~ Regexp.new(item)
             end
           end
         end
       end
     end
   end
 
   actions = %w{destroy list revoke generate sign print verify fingerprint}
   actions.each do |action|
     it { should be_action action }
     it "should fail #{action} when not a CA" do
       Puppet[:ca] = false
       expect {
         case subject.method(action).arity
         when -1 then subject.send(action)
         when -2 then subject.send(action, 'dummy')
         else
           raise "#{action} has arity #{subject.method(action).arity}"
         end
       }.should raise_error(/Not a CA/)
     end
   end
 end
diff --git a/spec/unit/face/certificate_spec.rb b/spec/unit/face/certificate_spec.rb
index 97253186e..15e7587e5 100755
--- a/spec/unit/face/certificate_spec.rb
+++ b/spec/unit/face/certificate_spec.rb
@@ -1,202 +1,202 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 require 'puppet/face'
 
 require 'puppet/ssl/host'
 
 describe Puppet::Face[:certificate, '0.0.1'] do
   include PuppetSpec::Files
 
   let(:ca) { Puppet::SSL::CertificateAuthority.instance }
 
   before :each do
     Puppet[:confdir] = tmpdir('conf')
     Puppet::SSL::CertificateAuthority.stubs(:ca?).returns true
 
     Puppet::SSL::Host.ca_location = :local
 
     # We can't cache the CA between tests, because each one has its own SSL dir.
     ca = Puppet::SSL::CertificateAuthority.new
     Puppet::SSL::CertificateAuthority.stubs(:new).returns ca
     Puppet::SSL::CertificateAuthority.stubs(:instance).returns ca
   end
 
   it "should have a ca-location option" do
     subject.should be_option :ca_location
   end
 
   it "should set the ca location when invoked" do
     Puppet::SSL::Host.expects(:ca_location=).with(:local)
     ca.expects(:sign).with do |name,options|
       name == "hello, friend"
     end
 
     subject.sign "hello, friend", :ca_location => :local
   end
 
   it "(#7059) should set the ca location when an inherited action is invoked" do
     Puppet::SSL::Host.expects(:ca_location=).with(:local)
     subject.indirection.expects(:find)
     subject.find "hello, friend", :ca_location => :local
   end
 
   it "should validate the option as required" do
     expect do
       subject.find 'hello, friend'
     end.to raise_exception ArgumentError, /required/i
   end
 
   it "should validate the option as a supported value" do
     expect do
       subject.find 'hello, friend', :ca_location => :foo
     end.to raise_exception ArgumentError, /valid values/i
   end
 
   describe "#generate" do
     let(:options) { {:ca_location => 'local'} }
     let(:host) { Puppet::SSL::Host.new(hostname) }
     let(:csr) { host.certificate_request }
 
     describe "for the current host" do
       let(:hostname) { Puppet[:certname] }
 
       it "should generate a CSR for this host" do
         subject.generate(hostname, options)
 
         csr.content.subject.to_s.should == "/CN=#{Puppet[:certname]}"
         csr.name.should == Puppet[:certname]
       end
 
       it "should add dns_alt_names from the global config if not otherwise specified" do
         Puppet[:dns_alt_names] = 'from,the,config'
 
         subject.generate(hostname, options)
 
         expected = %W[DNS:from DNS:the DNS:config DNS:#{hostname}]
 
         csr.subject_alt_names.should =~ expected
       end
 
       it "should add the provided dns_alt_names if they are specified" do
         Puppet[:dns_alt_names] = 'from,the,config'
 
         subject.generate(hostname, options.merge(:dns_alt_names => 'explicit,alt,names'))
 
         expected = %W[DNS:explicit DNS:alt DNS:names DNS:#{hostname}]
 
         csr.subject_alt_names.should =~ expected
       end
     end
 
     describe "for another host" do
       let(:hostname) { Puppet[:certname] + 'different' }
 
       it "should generate a CSR for the specified host" do
         subject.generate(hostname, options)
 
         csr.content.subject.to_s.should == "/CN=#{hostname}"
         csr.name.should == hostname
       end
 
       it "should fail if a CSR already exists for the host" do
         subject.generate(hostname, options)
 
         expect do
           subject.generate(hostname, options)
         end.to raise_error(RuntimeError, /#{hostname} already has a requested certificate; ignoring certificate request/)
       end
 
       it "should add not dns_alt_names from the config file" do
         Puppet[:dns_alt_names] = 'from,the,config'
 
         subject.generate(hostname, options)
 
         csr.subject_alt_names.should be_empty
       end
 
       it "should add the provided dns_alt_names if they are specified" do
         Puppet[:dns_alt_names] = 'from,the,config'
 
         subject.generate(hostname, options.merge(:dns_alt_names => 'explicit,alt,names'))
 
         expected = %W[DNS:explicit DNS:alt DNS:names DNS:#{hostname}]
 
         csr.subject_alt_names.should =~ expected
       end
     end
   end
 
   describe "#sign" do
     let(:options) { {:ca_location => 'local'} }
     let(:host) { Puppet::SSL::Host.new(hostname) }
     let(:hostname) { "foobar" }
 
     it "should sign the certificate request if one is waiting" do
       subject.generate(hostname, options)
 
       subject.sign(hostname, options)
 
       host.certificate_request.should be_nil
       host.certificate.should be_a(Puppet::SSL::Certificate)
       host.state.should == 'signed'
     end
 
     it "should fail if there is no waiting certificate request" do
       expect do
         subject.sign(hostname, options)
       end.to raise_error(ArgumentError, /Could not find certificate request for #{hostname}/)
     end
 
     describe "when ca_location is local" do
       describe "when the request has dns alt names" do
         before :each do
           subject.generate(hostname, options.merge(:dns_alt_names => 'some,alt,names'))
         end
 
         it "should refuse to sign the request if allow_dns_alt_names is not set" do
           expect do
             subject.sign(hostname, options)
           end.to raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError,
-                             /CSR contained subject alternative names (.*), which are disallowed./)
+                             /CSR '#{hostname}' contains subject alternative names \(.*?\), which are disallowed. Use `puppet cert --allow-dns-alt-names sign #{hostname}` to sign this request./i)
 
           host.state.should == 'requested'
         end
 
         it "should sign the request if allow_dns_alt_names is set" do
           expect do
             subject.sign(hostname, options.merge(:allow_dns_alt_names => true))
           end.not_to raise_error
 
           host.state.should == 'signed'
         end
       end
 
       describe "when the request has no dns alt names" do
         before :each do
           subject.generate(hostname, options)
         end
 
         it "should sign the request if allow_dns_alt_names is set" do
           expect { subject.sign(hostname, options.merge(:allow_dns_alt_names => true)) }.not_to raise_error
 
           host.state.should == 'signed'
         end
 
         it "should sign the request if allow_dns_alt_names is not set" do
           expect { subject.sign(hostname, options) }.not_to raise_error
 
           host.state.should == 'signed'
         end
       end
     end
 
     describe "when ca_location is remote" do
       let(:options) { {:ca_location => :remote} }
       it "should fail if allow-dns-alt-names is specified" do
         expect do
           subject.sign(hostname, options.merge(:allow_dns_alt_names => true))
         end
       end
     end
   end
 end
diff --git a/spec/unit/ssl/certificate_authority_spec.rb b/spec/unit/ssl/certificate_authority_spec.rb
index 1e67fa1af..222b72e5f 100755
--- a/spec/unit/ssl/certificate_authority_spec.rb
+++ b/spec/unit/ssl/certificate_authority_spec.rb
@@ -1,882 +1,882 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'puppet/ssl/certificate_authority'
 
 describe Puppet::SSL::CertificateAuthority do
   after do
     Puppet::SSL::CertificateAuthority.instance_variable_set(:@singleton_instance, nil)
     Puppet.settings.clearused
   end
 
   def stub_ca_host
     @key = mock 'key'
     @key.stubs(:content).returns "cakey"
     @cacert = mock 'certificate'
     @cacert.stubs(:content).returns "cacertificate"
 
     @host = stub 'ssl_host', :key => @key, :certificate => @cacert, :name => Puppet::SSL::Host.ca_name
   end
 
   it "should have a class method for returning a singleton instance" do
     Puppet::SSL::CertificateAuthority.should respond_to(:instance)
   end
 
   describe "when finding an existing instance" do
     describe "and the host is a CA host and the run_mode is master" do
       before do
         Puppet[:ca] = true
         Puppet.run_mode.stubs(:master?).returns true
 
         @ca = mock('ca')
         Puppet::SSL::CertificateAuthority.stubs(:new).returns @ca
       end
 
       it "should return an instance" do
         Puppet::SSL::CertificateAuthority.instance.should equal(@ca)
       end
 
       it "should always return the same instance" do
         Puppet::SSL::CertificateAuthority.instance.should equal(Puppet::SSL::CertificateAuthority.instance)
       end
     end
 
     describe "and the host is not a CA host" do
       it "should return nil" do
         Puppet.settings.stubs(:value).with(:ca).returns false
         Puppet.run_mode.stubs(:master?).returns true
 
         ca = mock('ca')
         Puppet::SSL::CertificateAuthority.expects(:new).never
         Puppet::SSL::CertificateAuthority.instance.should be_nil
       end
     end
 
     describe "and the run_mode is not master" do
       it "should return nil" do
         Puppet.settings.stubs(:value).with(:ca).returns true
         Puppet.run_mode.stubs(:master?).returns false
 
         ca = mock('ca')
         Puppet::SSL::CertificateAuthority.expects(:new).never
         Puppet::SSL::CertificateAuthority.instance.should be_nil
       end
     end
   end
 
   describe "when initializing" do
     before do
       Puppet.settings.stubs(:use)
       Puppet.settings.stubs(:value).returns "ca_testing"
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:setup)
     end
 
     it "should always set its name to the value of :certname" do
       Puppet.settings.expects(:value).with(:certname).returns "ca_testing"
 
       Puppet::SSL::CertificateAuthority.new.name.should == "ca_testing"
     end
 
     it "should create an SSL::Host instance whose name is the 'ca_name'" do
       Puppet::SSL::Host.expects(:ca_name).returns "caname"
 
       host = stub 'host'
       Puppet::SSL::Host.expects(:new).with("caname").returns host
 
       Puppet::SSL::CertificateAuthority.new
     end
 
     it "should use the :main, :ca, and :ssl settings sections" do
       Puppet.settings.expects(:use).with(:main, :ssl, :ca)
       Puppet::SSL::CertificateAuthority.new
     end
 
     it "should create an inventory instance" do
       Puppet::SSL::Inventory.expects(:new).returns "inventory"
 
       Puppet::SSL::CertificateAuthority.new.inventory.should == "inventory"
     end
 
     it "should make sure the CA is set up" do
       Puppet::SSL::CertificateAuthority.any_instance.expects(:setup)
 
       Puppet::SSL::CertificateAuthority.new
     end
   end
 
   describe "when setting itself up" do
     it "should generate the CA certificate if it does not have one" do
       Puppet.settings.stubs :use
 
       host = stub 'host'
       Puppet::SSL::Host.stubs(:new).returns host
 
       host.expects(:certificate).returns nil
 
       Puppet::SSL::CertificateAuthority.any_instance.expects(:generate_ca_certificate)
       Puppet::SSL::CertificateAuthority.new
     end
   end
 
   describe "when retrieving the certificate revocation list" do
     before do
       Puppet.settings.stubs(:use)
       Puppet.settings.stubs(:value).returns "ca_testing"
       Puppet.settings.stubs(:value).with(:cacrl).returns "/my/crl"
 
       cert = stub("certificate", :content => "real_cert")
       key = stub("key", :content => "real_key")
       @host = stub 'host', :certificate => cert, :name => "hostname", :key => key
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:setup)
       @ca = Puppet::SSL::CertificateAuthority.new
 
       @ca.stubs(:host).returns @host
     end
 
     it "should return any found CRL instance" do
       crl = mock 'crl'
       Puppet::SSL::CertificateRevocationList.indirection.expects(:find).returns crl
       @ca.crl.should equal(crl)
     end
 
     it "should create, generate, and save a new CRL instance of no CRL can be found" do
       crl = Puppet::SSL::CertificateRevocationList.new("fakename")
       Puppet::SSL::CertificateRevocationList.indirection.expects(:find).returns nil
 
       Puppet::SSL::CertificateRevocationList.expects(:new).returns crl
 
       crl.expects(:generate).with(@ca.host.certificate.content, @ca.host.key.content)
       Puppet::SSL::CertificateRevocationList.indirection.expects(:save).with(crl)
 
       @ca.crl.should equal(crl)
     end
   end
 
   describe "when generating a self-signed CA certificate" do
     before do
       Puppet.settings.stubs(:use)
       Puppet.settings.stubs(:value).returns "ca_testing"
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:setup)
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:crl)
       @ca = Puppet::SSL::CertificateAuthority.new
 
       @host = stub 'host', :key => mock("key"), :name => "hostname", :certificate => mock('certificate')
 
       Puppet::SSL::CertificateRequest.any_instance.stubs(:generate)
 
       @ca.stubs(:host).returns @host
     end
 
     it "should create and store a password at :capass" do
       Puppet.settings.expects(:value).with(:capass).returns "/path/to/pass"
 
       FileTest.expects(:exist?).with("/path/to/pass").returns false
 
       fh = mock 'filehandle'
       Puppet.settings.expects(:write).with(:capass).yields fh
 
       fh.expects(:print).with { |s| s.length > 18 }
 
       @ca.stubs(:sign)
 
       @ca.generate_ca_certificate
     end
 
     it "should generate a key if one does not exist" do
       @ca.stubs :generate_password
       @ca.stubs :sign
 
       @ca.host.expects(:key).returns nil
       @ca.host.expects(:generate_key)
 
       @ca.generate_ca_certificate
     end
 
     it "should create and sign a self-signed cert using the CA name" do
       request = mock 'request'
       Puppet::SSL::CertificateRequest.expects(:new).with(@ca.host.name).returns request
       request.expects(:generate).with(@ca.host.key)
       request.stubs(:request_extensions => [])
 
       @ca.expects(:sign).with(@host.name, false, request)
 
       @ca.stubs :generate_password
 
       @ca.generate_ca_certificate
     end
 
     it "should generate its CRL" do
       @ca.stubs :generate_password
       @ca.stubs :sign
 
       @ca.host.expects(:key).returns nil
       @ca.host.expects(:generate_key)
 
       @ca.expects(:crl)
 
       @ca.generate_ca_certificate
     end
   end
 
   describe "when signing" do
     before do
       Puppet.settings.stubs(:use)
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:password?).returns true
 
       stub_ca_host
 
       Puppet::SSL::Host.expects(:new).with(Puppet::SSL::Host.ca_name).returns @host
 
       @ca = Puppet::SSL::CertificateAuthority.new
 
       @name = "myhost"
       @real_cert = stub 'realcert', :sign => nil
       @cert = Puppet::SSL::Certificate.new(@name)
       @cert.content = @real_cert
 
       Puppet::SSL::Certificate.stubs(:new).returns @cert
 
       @cert.stubs(:content=)
       Puppet::SSL::Certificate.indirection.stubs(:save)
 
       # Stub out the factory
       Puppet::SSL::CertificateFactory.stubs(:build).returns "my real cert"
 
       @request_content = stub "request content stub", :subject => @name
       @request = stub 'request', :name => @name, :request_extensions => [], :subject_alt_names => [], :content => @request_content
 
       # And the inventory
       @inventory = stub 'inventory', :add => nil
       @ca.stubs(:inventory).returns @inventory
 
       Puppet::SSL::CertificateRequest.indirection.stubs(:destroy)
     end
 
     describe "and calculating the next certificate serial number" do
       before do
         @path = "/path/to/serial"
         Puppet.settings.stubs(:value).with(:serial).returns @path
 
         @filehandle = stub 'filehandle', :<< => @filehandle
         Puppet.settings.stubs(:readwritelock).with(:serial).yields @filehandle
       end
 
       it "should default to 0x1 for the first serial number" do
         @ca.next_serial.should == 0x1
       end
 
       it "should return the current content of the serial file" do
         FileTest.stubs(:exist?).with(@path).returns true
         File.expects(:read).with(@path).returns "0002"
 
         @ca.next_serial.should == 2
       end
 
       it "should write the next serial number to the serial file as hex" do
         @filehandle.expects(:<<).with("0002")
 
         @ca.next_serial
       end
 
       it "should lock the serial file while writing" do
         Puppet.settings.expects(:readwritelock).with(:serial)
 
         @ca.next_serial
       end
     end
 
     describe "its own certificate" do
       before do
         @serial = 10
         @ca.stubs(:next_serial).returns @serial
       end
 
       it "should not look up a certificate request for the host" do
         Puppet::SSL::CertificateRequest.indirection.expects(:find).never
 
         @ca.sign(@name, true, @request)
       end
 
       it "should use a certificate type of :ca" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[0] == :ca
         end.returns "my real cert"
         @ca.sign(@name, :ca, @request)
       end
 
       it "should pass the provided CSR as the CSR" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[1] == @request
         end.returns "my real cert"
         @ca.sign(@name, :ca, @request)
       end
 
       it "should use the provided CSR's content as the issuer" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[2].subject == "myhost"
         end.returns "my real cert"
         @ca.sign(@name, :ca, @request)
       end
 
       it "should pass the next serial as the serial number" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[3] == @serial
         end.returns "my real cert"
         @ca.sign(@name, :ca, @request)
       end
 
       it "should sign the certificate request even if it contains alt names" do
         @request.stubs(:subject_alt_names).returns %w[DNS:foo DNS:bar DNS:baz]
 
         expect do
           @ca.sign(@name, false, @request)
         end.should_not raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError)
       end
 
       it "should save the resulting certificate" do
         Puppet::SSL::Certificate.indirection.expects(:save).with(@cert)
 
         @ca.sign(@name, :ca, @request)
       end
     end
 
     describe "another host's certificate" do
       before do
         @serial = 10
         @ca.stubs(:next_serial).returns @serial
 
         Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
         Puppet::SSL::CertificateRequest.indirection.stubs :save
       end
 
       it "should use a certificate type of :server" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[0] == :server
         end.returns "my real cert"
 
         @ca.sign(@name)
       end
 
       it "should use look up a CSR for the host in the :ca_file terminus" do
         Puppet::SSL::CertificateRequest.indirection.expects(:find).with(@name).returns @request
 
         @ca.sign(@name)
       end
 
       it "should fail if no CSR can be found for the host" do
         Puppet::SSL::CertificateRequest.indirection.expects(:find).with(@name).returns nil
 
         lambda { @ca.sign(@name) }.should raise_error(ArgumentError)
       end
 
       it "should fail if an unknown request extension is present" do
         @request.stubs :request_extensions => [{ "oid"   => "bananas",
                                                  "value" => "delicious" }]
         expect { @ca.sign(@name) }.
           should raise_error(/CSR has request extensions that are not permitted/)
       end
 
       it "should fail if the CSR contains alt names and they are not expected" do
         @request.stubs(:subject_alt_names).returns %w[DNS:foo DNS:bar DNS:baz]
 
         expect do
           @ca.sign(@name, false)
-        end.to raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError, /CSR contained subject alternative names/)
+        end.to raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError, /CSR '#{@name}' contains subject alternative names \(.*?\), which are disallowed. Use `puppet cert --allow-dns-alt-names sign #{@name}` to sign this request./)
       end
 
       it "should not fail if the CSR does not contain alt names and they are expected" do
         @request.stubs(:subject_alt_names).returns []
         expect { @ca.sign(@name, true) }.should_not raise_error
       end
 
       it "should reject alt names by default" do
         @request.stubs(:subject_alt_names).returns %w[DNS:foo DNS:bar DNS:baz]
 
         expect do
           @ca.sign(@name)
-        end.to raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError, /CSR contained subject alternative names/)
+        end.to raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError, /CSR '#{@name}' contains subject alternative names \(.*?\), which are disallowed. Use `puppet cert --allow-dns-alt-names sign #{@name}` to sign this request./)
       end
 
       it "should use the CA certificate as the issuer" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[2] == @cacert.content
         end.returns "my real cert"
         @ca.sign(@name)
       end
 
       it "should pass the next serial as the serial number" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[3] == @serial
         end.returns "my real cert"
         @ca.sign(@name)
       end
 
       it "should sign the resulting certificate using its real key and a digest" do
         digest = mock 'digest'
         OpenSSL::Digest::SHA1.expects(:new).returns digest
 
         key = stub 'key', :content => "real_key"
         @ca.host.stubs(:key).returns key
 
         @cert.content.expects(:sign).with("real_key", digest)
         @ca.sign(@name)
       end
 
       it "should save the resulting certificate" do
         Puppet::SSL::Certificate.indirection.stubs(:save).with(@cert)
         @ca.sign(@name)
       end
 
       it "should remove the host's certificate request" do
         Puppet::SSL::CertificateRequest.indirection.expects(:destroy).with(@name)
 
         @ca.sign(@name)
       end
 
       it "should check the internal signing policies" do
         @ca.expects(:check_internal_signing_policies).returns true
         @ca.sign(@name)
       end
     end
 
     context "#check_internal_signing_policies" do
       before do
         @serial = 10
         @ca.stubs(:next_serial).returns @serial
 
         Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
         @cert.stubs :save
       end
 
       it "should reject a critical extension that isn't on the whitelist" do
         @request.stubs(:request_extensions).returns [{ "oid" => "banana",
                                                        "value" => "yumm",
                                                        "critical" => true }]
         expect { @ca.sign(@name) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /request extensions that are not permitted/
         )
       end
 
       it "should reject a non-critical extension that isn't on the whitelist" do
         @request.stubs(:request_extensions).returns [{ "oid" => "peach",
                                                        "value" => "meh",
                                                        "critical" => false }]
         expect { @ca.sign(@name) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /request extensions that are not permitted/
         )
       end
 
       it "should reject non-whitelist extensions even if a valid extension is present" do
         @request.stubs(:request_extensions).returns [{ "oid" => "peach",
                                                        "value" => "meh",
                                                        "critical" => false },
                                                      { "oid" => "subjectAltName",
                                                        "value" => "DNS:foo",
                                                        "critical" => true }]
         expect { @ca.sign(@name) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /request extensions that are not permitted/
         )
       end
 
       it "should reject a subjectAltName for a non-DNS value" do
         @request.stubs(:subject_alt_names).returns ['DNS:foo', 'email:bar@example.com']
         expect { @ca.sign(@name, true) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /subjectAltName outside the DNS label space/
         )
       end
 
       it "should reject a wildcard subject" do
         @request.content.stubs(:subject).
           returns(OpenSSL::X509::Name.new([["CN", "*.local"]]))
 
         expect { @ca.sign(@name) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /subject contains a wildcard/
         )
       end
 
       it "should reject a wildcard subjectAltName" do
         @request.stubs(:subject_alt_names).returns ['DNS:foo', 'DNS:*.bar']
         expect { @ca.sign(@name, true) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /subjectAltName contains a wildcard/
         )
       end
     end
 
     it "should create a certificate instance with the content set to the newly signed x509 certificate" do
       @serial = 10
       @ca.stubs(:next_serial).returns @serial
 
       Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
       Puppet::SSL::Certificate.indirection.stubs :save
       Puppet::SSL::Certificate.expects(:new).with(@name).returns @cert
 
       @ca.sign(@name)
     end
 
     it "should return the certificate instance" do
       @ca.stubs(:next_serial).returns @serial
       Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
       Puppet::SSL::Certificate.indirection.stubs :save
       @ca.sign(@name).should equal(@cert)
     end
 
     it "should add the certificate to its inventory" do
       @ca.stubs(:next_serial).returns @serial
       @inventory.expects(:add).with(@cert)
 
       Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
       Puppet::SSL::Certificate.indirection.stubs :save
       @ca.sign(@name)
     end
 
     it "should have a method for triggering autosigning of available CSRs" do
       @ca.should respond_to(:autosign)
     end
 
     describe "when autosigning certificates" do
       it "should do nothing if autosign is disabled" do
         Puppet.settings.expects(:value).with(:autosign).returns 'false'
 
         Puppet::SSL::CertificateRequest.indirection.expects(:search).never
         @ca.autosign
       end
 
       it "should do nothing if no autosign.conf exists" do
         Puppet.settings.expects(:value).with(:autosign).returns '/auto/sign'
         FileTest.expects(:exist?).with("/auto/sign").returns false
 
         Puppet::SSL::CertificateRequest.indirection.expects(:search).never
         @ca.autosign
       end
 
       describe "and autosign is enabled and the autosign.conf file exists" do
         before do
           Puppet.settings.stubs(:value).with(:autosign).returns '/auto/sign'
           FileTest.stubs(:exist?).with("/auto/sign").returns true
           File.stubs(:readlines).with("/auto/sign").returns ["one\n", "two\n"]
 
           Puppet::SSL::CertificateRequest.indirection.stubs(:search).returns []
 
           @store = stub 'store', :allow => nil
           Puppet::Network::AuthStore.stubs(:new).returns @store
         end
 
         describe "when creating the AuthStore instance to verify autosigning" do
           it "should create an AuthStore with each line in the configuration file allowed to be autosigned" do
             Puppet::Network::AuthStore.expects(:new).returns @store
 
             @store.expects(:allow).with("one")
             @store.expects(:allow).with("two")
 
             @ca.autosign
           end
 
           it "should reparse the autosign configuration on each call" do
             Puppet::Network::AuthStore.expects(:new).times(2).returns @store
 
             @ca.autosign
             @ca.autosign
           end
 
           it "should ignore comments" do
             File.stubs(:readlines).with("/auto/sign").returns ["one\n", "#two\n"]
 
             @store.expects(:allow).with("one")
             @ca.autosign
           end
 
           it "should ignore blank lines" do
             File.stubs(:readlines).with("/auto/sign").returns ["one\n", "\n"]
 
             @store.expects(:allow).with("one")
             @ca.autosign
           end
         end
 
         it "should sign all CSRs whose hostname matches the autosign configuration" do
           csr1 = mock 'csr1'
           csr2 = mock 'csr2'
           Puppet::SSL::CertificateRequest.indirection.stubs(:search).returns [csr1, csr2]
         end
 
         it "should not sign CSRs whose hostname does not match the autosign configuration" do
           csr1 = mock 'csr1'
           csr2 = mock 'csr2'
           Puppet::SSL::CertificateRequest.indirection.stubs(:search).returns [csr1, csr2]
         end
       end
     end
   end
 
   describe "when managing certificate clients" do
     before do
       Puppet.settings.stubs(:use)
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:password?).returns true
 
       stub_ca_host
 
       Puppet::SSL::Host.expects(:new).returns @host
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:host).returns @host
 
       @cacert = mock 'certificate'
       @cacert.stubs(:content).returns "cacertificate"
       @ca = Puppet::SSL::CertificateAuthority.new
     end
 
     it "should have a method for acting on the SSL files" do
       @ca.should respond_to(:apply)
     end
 
     describe "when applying a method to a set of hosts" do
       it "should fail if no subjects have been specified" do
         lambda { @ca.apply(:generate) }.should raise_error(ArgumentError)
       end
 
       it "should create an Interface instance with the specified method and the options" do
         Puppet::SSL::CertificateAuthority::Interface.expects(:new).with(:generate, :to => :host).returns(stub('applier', :apply => nil))
         @ca.apply(:generate, :to => :host)
       end
 
       it "should apply the Interface with itself as the argument" do
         applier = stub('applier')
         applier.expects(:apply).with(@ca)
         Puppet::SSL::CertificateAuthority::Interface.expects(:new).returns applier
         @ca.apply(:generate, :to => :ca_testing)
       end
     end
 
     it "should be able to list waiting certificate requests" do
       req1 = stub 'req1', :name => "one"
       req2 = stub 'req2', :name => "two"
       Puppet::SSL::CertificateRequest.indirection.expects(:search).with("*").returns [req1, req2]
 
       @ca.waiting?.should == %w{one two}
     end
 
     it "should delegate removing hosts to the Host class" do
       Puppet::SSL::Host.expects(:destroy).with("myhost")
 
       @ca.destroy("myhost")
     end
 
     it "should be able to verify certificates" do
       @ca.should respond_to(:verify)
     end
 
     it "should list certificates as the sorted list of all existing signed certificates" do
       cert1 = stub 'cert1', :name => "cert1"
       cert2 = stub 'cert2', :name => "cert2"
       Puppet::SSL::Certificate.indirection.expects(:search).with("*").returns [cert1, cert2]
       @ca.list.should == %w{cert1 cert2}
     end
 
     describe "and printing certificates" do
       it "should return nil if the certificate cannot be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns nil
         @ca.print("myhost").should be_nil
       end
 
       it "should print certificates by calling :to_text on the host's certificate" do
         cert1 = stub 'cert1', :name => "cert1", :to_text => "mytext"
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns cert1
         @ca.print("myhost").should == "mytext"
       end
     end
 
     describe "and fingerprinting certificates" do
       before :each do
         @cert = stub 'cert', :name => "cert", :fingerprint => "DIGEST"
         Puppet::SSL::Certificate.indirection.stubs(:find).with("myhost").returns @cert
         Puppet::SSL::CertificateRequest.indirection.stubs(:find).with("myhost")
       end
 
       it "should raise an error if the certificate or CSR cannot be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns nil
         Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myhost").returns nil
         lambda { @ca.fingerprint("myhost") }.should raise_error
       end
 
       it "should try to find a CSR if no certificate can be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns nil
         Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myhost").returns @cert
         @cert.expects(:fingerprint)
         @ca.fingerprint("myhost")
       end
 
       it "should delegate to the certificate fingerprinting" do
         @cert.expects(:fingerprint)
         @ca.fingerprint("myhost")
       end
 
       it "should propagate the digest algorithm to the certificate fingerprinting system" do
         @cert.expects(:fingerprint).with(:digest)
         @ca.fingerprint("myhost", :digest)
       end
     end
 
     describe "and verifying certificates" do
       before do
         @store = stub 'store', :verify => true, :add_file => nil, :purpose= => nil, :add_crl => true, :flags= => nil
 
         OpenSSL::X509::Store.stubs(:new).returns @store
 
         Puppet.settings.stubs(:value).returns "crtstuff"
 
         @cert = stub 'cert', :content => "mycert"
         Puppet::SSL::Certificate.indirection.stubs(:find).returns @cert
 
         @crl = stub('crl', :content => "mycrl")
 
         @ca.stubs(:crl).returns @crl
       end
 
       it "should fail if the host's certificate cannot be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("me").returns(nil)
 
         lambda { @ca.verify("me") }.should raise_error(ArgumentError)
       end
 
       it "should create an SSL Store to verify" do
         OpenSSL::X509::Store.expects(:new).returns @store
 
         @ca.verify("me")
       end
 
       it "should add the CA Certificate to the store" do
         Puppet.settings.stubs(:value).with(:cacert).returns "/ca/cert"
         @store.expects(:add_file).with "/ca/cert"
 
         @ca.verify("me")
       end
 
       it "should add the CRL to the store if the crl is enabled" do
         @store.expects(:add_crl).with "mycrl"
 
         @ca.verify("me")
       end
 
       it "should set the store purpose to OpenSSL::X509::PURPOSE_SSL_CLIENT" do
         Puppet.settings.stubs(:value).with(:cacert).returns "/ca/cert"
         @store.expects(:add_file).with "/ca/cert"
 
         @ca.verify("me")
       end
 
       it "should set the store flags to check the crl" do
         @store.expects(:flags=).with OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK
 
         @ca.verify("me")
       end
 
       it "should use the store to verify the certificate" do
         @cert.expects(:content).returns "mycert"
 
         @store.expects(:verify).with("mycert").returns true
 
         @ca.verify("me")
       end
 
       it "should fail if the verification returns false" do
         @cert.expects(:content).returns "mycert"
 
         @store.expects(:verify).with("mycert").returns false
 
         lambda { @ca.verify("me") }.should raise_error
       end
     end
 
     describe "and revoking certificates" do
       before do
         @crl = mock 'crl'
         @ca.stubs(:crl).returns @crl
 
         @ca.stubs(:next_serial).returns 10
 
         @real_cert = stub 'real_cert', :serial => 15
         @cert = stub 'cert', :content => @real_cert
         Puppet::SSL::Certificate.indirection.stubs(:find).returns @cert
 
       end
 
       it "should fail if the certificate revocation list is disabled" do
         @ca.stubs(:crl).returns false
 
         lambda { @ca.revoke('ca_testing') }.should raise_error(ArgumentError)
 
       end
 
       it "should delegate the revocation to its CRL" do
         @ca.crl.expects(:revoke)
 
         @ca.revoke('host')
       end
 
       it "should get the serial number from the local certificate if it exists" do
         @ca.crl.expects(:revoke).with { |serial, key| serial == 15 }
 
         Puppet::SSL::Certificate.indirection.expects(:find).with("host").returns @cert
 
         @ca.revoke('host')
       end
 
       it "should get the serial number from inventory if no local certificate exists" do
         real_cert = stub 'real_cert', :serial => 15
         cert = stub 'cert', :content => real_cert
         Puppet::SSL::Certificate.indirection.expects(:find).with("host").returns nil
 
         @ca.inventory.expects(:serial).with("host").returns 16
 
         @ca.crl.expects(:revoke).with { |serial, key| serial == 16 }
         @ca.revoke('host')
       end
     end
 
     it "should be able to generate a complete new SSL host" do
       @ca.should respond_to(:generate)
     end
 
     describe "and generating certificates" do
       before do
         @host = stub 'host', :generate_certificate_request => nil
         Puppet::SSL::Host.stubs(:new).returns @host
         Puppet::SSL::Certificate.indirection.stubs(:find).returns nil
 
         @ca.stubs(:sign)
       end
 
       it "should fail if a certificate already exists for the host" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("him").returns "something"
 
         lambda { @ca.generate("him") }.should raise_error(ArgumentError)
       end
 
       it "should create a new Host instance with the correct name" do
         Puppet::SSL::Host.expects(:new).with("him").returns @host
 
         @ca.generate("him")
       end
 
       it "should use the Host to generate the certificate request" do
         @host.expects :generate_certificate_request
 
         @ca.generate("him")
       end
 
       it "should sign the generated request" do
         @ca.expects(:sign).with("him", false)
         @ca.generate("him")
       end
     end
   end
 end