diff --git a/lib/puppet/configurer.rb b/lib/puppet/configurer.rb
index 736f494ce..4638f611c 100644
--- a/lib/puppet/configurer.rb
+++ b/lib/puppet/configurer.rb
@@ -1,263 +1,266 @@
 # The client for interacting with the puppetmaster config server.
 require 'sync'
 require 'timeout'
 require 'puppet/network/http_pool'
 require 'puppet/util'
 require 'securerandom'
 
 class Puppet::Configurer
   require 'puppet/configurer/fact_handler'
   require 'puppet/configurer/plugin_handler'
 
   include Puppet::Configurer::FactHandler
   include Puppet::Configurer::PluginHandler
 
   # For benchmarking
   include Puppet::Util
 
   attr_reader :compile_time, :environment
 
   # Provide more helpful strings to the logging that the Agent does
   def self.to_s
     "Puppet configuration client"
   end
 
   def execute_postrun_command
     execute_from_setting(:postrun_command)
   end
 
   def execute_prerun_command
     execute_from_setting(:prerun_command)
   end
 
   # Initialize and load storage
   def init_storage
       Puppet::Util::Storage.load
       @compile_time ||= Puppet::Util::Storage.cache(:configuration)[:compile_time]
   rescue => detail
     Puppet.log_exception(detail, "Removing corrupt state file #{Puppet[:statefile]}: #{detail}")
     begin
       Puppet::FileSystem.unlink(Puppet[:statefile])
       retry
     rescue => detail
       raise Puppet::Error.new("Cannot remove #{Puppet[:statefile]}: #{detail}", detail)
     end
   end
 
   def initialize
     Puppet.settings.use(:main, :ssl, :agent)
 
     @running = false
     @splayed = false
     @environment = Puppet[:environment]
     @transaction_uuid = SecureRandom.uuid
   end
 
   # Get the remote catalog, yo.  Returns nil if no catalog can be found.
   def retrieve_catalog(query_options)
     query_options ||= {}
     # First try it with no cache, then with the cache.
     unless (Puppet[:use_cached_catalog] and result = retrieve_catalog_from_cache(query_options)) or result = retrieve_new_catalog(query_options)
       if ! Puppet[:usecacheonfailure]
         Puppet.warning "Not using cache on failed catalog"
         return nil
       end
       result = retrieve_catalog_from_cache(query_options)
     end
 
     return nil unless result
 
     convert_catalog(result, @duration)
   end
 
   # Convert a plain resource catalog into our full host catalog.
   def convert_catalog(result, duration)
     catalog = result.to_ral
     catalog.finalize
     catalog.retrieval_duration = duration
     catalog.write_class_file
     catalog.write_resource_file
     catalog
   end
 
   def get_facts(options)
     if options[:pluginsync]
       remote_environment_for_plugins = Puppet::Node::Environment.remote(@environment)
       download_plugins(remote_environment_for_plugins)
     end
 
     if Puppet::Resource::Catalog.indirection.terminus_class == :rest
       # This is a bit complicated.  We need the serialized and escaped facts,
       # and we need to know which format they're encoded in.  Thus, we
       # get a hash with both of these pieces of information.
       #
       # facts_for_uploading may set Puppet[:node_name_value] as a side effect
       return facts_for_uploading
     end
   end
 
   def prepare_and_retrieve_catalog(options, query_options)
     # set report host name now that we have the fact
     options[:report].host = Puppet[:node_name_value]
 
     unless catalog = (options.delete(:catalog) || retrieve_catalog(query_options))
       Puppet.err "Could not retrieve catalog; skipping run"
       return
     end
     catalog
   end
 
   # Retrieve (optionally) and apply a catalog. If a catalog is passed in
   # the options, then apply that one, otherwise retrieve it.
   def apply_catalog(catalog, options)
     report = options[:report]
     report.configuration_version = catalog.version
 
     benchmark(:notice, "Finished catalog run") do
       catalog.apply(options)
     end
 
     report.finalize_report
     report
   end
 
   # The code that actually runs the catalog.
   # This just passes any options on to the catalog,
   # which accepts :tags and :ignoreschedules.
   def run(options = {})
     # We create the report pre-populated with default settings for
     # environment and transaction_uuid very early, this is to ensure
     # they are sent regardless of any catalog compilation failures or
     # exceptions.
     options[:report] ||= Puppet::Transaction::Report.new("apply", nil, @environment, @transaction_uuid)
     report = options[:report]
     init_storage
 
     Puppet::Util::Log.newdestination(report)
 
     begin
       unless Puppet[:node_name_fact].empty?
         query_options = get_facts(options)
       end
 
       # We only need to find out the environment to run in if we don't already have a catalog
       unless options[:catalog]
         begin
           if node = Puppet::Node.indirection.find(Puppet[:node_name_value],
-              :environment => @environment, :ignore_cache => true, :transaction_uuid => @transaction_uuid)
+              :environment => @environment, :ignore_cache => true, :transaction_uuid => @transaction_uuid,
+              :fail_on_404 => true)
             if node.environment.to_s != @environment
               Puppet.warning "Local environment: \"#{@environment}\" doesn't match server specified node environment \"#{node.environment}\", switching agent to \"#{node.environment}\"."
               @environment = node.environment.to_s
               report.environment = @environment
               query_options = nil
             end
           end
         rescue SystemExit,NoMemoryError
           raise
         rescue Exception => detail
           Puppet.warning("Unable to fetch my node definition, but the agent run will continue:")
           Puppet.warning(detail)
         end
       end
 
       query_options = get_facts(options) unless query_options
 
       # get_facts returns nil during puppet apply
       query_options ||= {}
       query_options[:transaction_uuid] = @transaction_uuid
 
       unless catalog = prepare_and_retrieve_catalog(options, query_options)
         return nil
       end
 
       # Here we set the local environment based on what we get from the
       # catalog. Since a change in environment means a change in facts, and
       # facts may be used to determine which catalog we get, we need to
       # rerun the process if the environment is changed.
       tries = 0
       while catalog.environment and not catalog.environment.empty? and catalog.environment != @environment
         if tries > 3
           raise Puppet::Error, "Catalog environment didn't stabilize after #{tries} fetches, aborting run"
         end
         Puppet.warning "Local environment: \"#{@environment}\" doesn't match server specified environment \"#{catalog.environment}\", restarting agent run with environment \"#{catalog.environment}\""
         @environment = catalog.environment
         report.environment = @environment
         return nil unless catalog = prepare_and_retrieve_catalog(options, query_options)
         tries += 1
       end
 
       execute_prerun_command or return nil
       apply_catalog(catalog, options)
       report.exit_status
     rescue => detail
       Puppet.log_exception(detail, "Failed to apply catalog: #{detail}")
       return nil
     ensure
       execute_postrun_command or return nil
     end
   ensure
     # Between Puppet runs we need to forget the cached values.  This lets us
     # pick up on new functions installed by gems or new modules being added
     # without the daemon being restarted.
     $env_module_directories = nil
 
     Puppet::Util::Log.close(report)
     send_report(report)
   end
 
   def send_report(report)
     puts report.summary if Puppet[:summarize]
     save_last_run_summary(report)
     Puppet::Transaction::Report.indirection.save(report, nil, :environment => @environment) if Puppet[:report]
   rescue => detail
     Puppet.log_exception(detail, "Could not send report: #{detail}")
   end
 
   def save_last_run_summary(report)
     mode = Puppet.settings.setting(:lastrunfile).mode
     Puppet::Util.replace_file(Puppet[:lastrunfile], mode) do |fh|
       fh.print YAML.dump(report.raw_summary)
     end
   rescue => detail
     Puppet.log_exception(detail, "Could not save last run local report: #{detail}")
   end
 
   private
 
   def execute_from_setting(setting)
     return true if (command = Puppet[setting]) == ""
 
     begin
       Puppet::Util::Execution.execute([command])
       true
     rescue => detail
       Puppet.log_exception(detail, "Could not run command from #{setting}: #{detail}")
       false
     end
   end
 
   def retrieve_catalog_from_cache(query_options)
     result = nil
     @duration = thinmark do
-      result = Puppet::Resource::Catalog.indirection.find(Puppet[:node_name_value], query_options.merge(:ignore_terminus => true, :environment => @environment))
+      result = Puppet::Resource::Catalog.indirection.find(Puppet[:node_name_value],
+        query_options.merge(:ignore_terminus => true, :environment => @environment))
     end
     Puppet.notice "Using cached catalog"
     result
   rescue => detail
     Puppet.log_exception(detail, "Could not retrieve catalog from cache: #{detail}")
     return nil
   end
 
   def retrieve_new_catalog(query_options)
     result = nil
     @duration = thinmark do
-      result = Puppet::Resource::Catalog.indirection.find(Puppet[:node_name_value], query_options.merge(:ignore_cache => true, :environment => @environment))
+      result = Puppet::Resource::Catalog.indirection.find(Puppet[:node_name_value],
+        query_options.merge(:ignore_cache => true, :environment => @environment, :fail_on_404 => true))
     end
     result
   rescue SystemExit,NoMemoryError
     raise
   rescue Exception => detail
     Puppet.log_exception(detail, "Could not retrieve catalog from remote server: #{detail}")
     return nil
   end
 end
diff --git a/lib/puppet/indirector/rest.rb b/lib/puppet/indirector/rest.rb
index 1697aa55f..8c10c33e0 100644
--- a/lib/puppet/indirector/rest.rb
+++ b/lib/puppet/indirector/rest.rb
@@ -1,264 +1,263 @@
 require 'net/http'
 require 'uri'
 
 require 'puppet/network/http'
 require 'puppet/network/http_pool'
 require 'puppet/network/http/api/v1'
 require 'puppet/network/http/compression'
 
 # Access objects via REST
 class Puppet::Indirector::REST < Puppet::Indirector::Terminus
   include Puppet::Network::HTTP::Compression.module
 
   class << self
     attr_reader :server_setting, :port_setting
   end
 
   # Specify the setting that we should use to get the server name.
   def self.use_server_setting(setting)
     @server_setting = setting
   end
 
   # Specify the setting that we should use to get the port.
   def self.use_port_setting(setting)
     @port_setting = setting
   end
 
   # Specify the service to use when doing SRV record lookup
   def self.use_srv_service(service)
     @srv_service = service
   end
 
   def self.srv_service
     @srv_service || :puppet
   end
 
   def self.server
     Puppet.settings[server_setting || :server]
   end
 
   def self.port
     Puppet.settings[port_setting || :masterport].to_i
   end
 
   # Provide appropriate headers.
   def headers
     add_accept_encoding({"Accept" => model.supported_formats.join(", ")})
   end
 
   def add_profiling_header(headers)
     if (Puppet[:profile])
       headers[Puppet::Network::HTTP::HEADER_ENABLE_PROFILING] = "true"
     end
     headers
   end
 
   def network(request)
     Puppet::Network::HttpPool.http_instance(request.server || self.class.server,
                                             request.port || self.class.port)
   end
 
   def http_get(request, path, headers = nil, *args)
     http_request(:get, request, path, add_profiling_header(headers), *args)
   end
 
   def http_post(request, path, data, headers = nil, *args)
     http_request(:post, request, path, data, add_profiling_header(headers), *args)
   end
 
   def http_head(request, path, headers = nil, *args)
     http_request(:head, request, path, add_profiling_header(headers), *args)
   end
 
   def http_delete(request, path, headers = nil, *args)
     http_request(:delete, request, path, add_profiling_header(headers), *args)
   end
 
   def http_put(request, path, data, headers = nil, *args)
     http_request(:put, request, path, data, add_profiling_header(headers), *args)
   end
 
   def http_request(method, request, *args)
     conn = network(request)
     conn.send(method, *args)
   end
 
   def find(request)
     uri, body = Puppet::Network::HTTP::API::V1.request_to_uri_and_body(request)
     uri_with_query_string = "#{uri}?#{body}"
 
     response = do_request(request) do |request|
       # WEBrick in Ruby 1.9.1 only supports up to 1024 character lines in an HTTP request
       # http://redmine.ruby-lang.org/issues/show/3991
       if "GET #{uri_with_query_string} HTTP/1.1\r\n".length > 1024
         http_post(request, uri, body, headers)
       else
         http_get(request, uri_with_query_string, headers)
       end
     end
 
     if is_http_200?(response)
       check_master_version(response)
       content_type, body = parse_response(response)
       result = deserialize_find(content_type, body)
       result.name = request.key if result.respond_to?(:name=)
       result
 
     elsif is_http_404?(response)
-      # 404 gets special treatment as the indirector API can not produce a meaningful
+      return nil unless request.options[:fail_on_404]
+
+      # 404 can get special treatment as the indirector API can not produce a meaningful
       # reason to why something is not found - it may not be the thing the user is
       # expecting to find that is missing, but something else (like the environment).
-      # While this way of handling the issue is not perfect, there is at least a warning
+      # While this way of handling the issue is not perfect, there is at least an error
       # that makes a user aware of the reason for the failure.
       #
       content_type, body = parse_response(response)
       msg = "Find #{uri_with_query_string} resulted in 404 with the message: #{body}"
-      # warn_once
-      Puppet::Util::Warnings.maybe_log(msg, self.class){ Puppet.warning msg }
-      nil
-
+      raise Puppet::Error, msg
     else
       nil
     end
   end
 
   def head(request)
     response = do_request(request) do |request|
       http_head(request, Puppet::Network::HTTP::API::V1.indirection2uri(request), headers)
     end
 
     if is_http_200?(response)
       check_master_version(response)
       true
     else
       false
     end
   end
 
   def search(request)
     response = do_request(request) do |request|
       http_get(request, Puppet::Network::HTTP::API::V1.indirection2uri(request), headers)
     end
 
     if is_http_200?(response)
       check_master_version(response)
       content_type, body = parse_response(response)
       deserialize_search(content_type, body) || []
     else
       []
     end
   end
 
   def destroy(request)
     raise ArgumentError, "DELETE does not accept options" unless request.options.empty?
 
     response = do_request(request) do |request|
       http_delete(request, Puppet::Network::HTTP::API::V1.indirection2uri(request), headers)
     end
 
     if is_http_200?(response)
       check_master_version(response)
       content_type, body = parse_response(response)
       deserialize_destroy(content_type, body)
     else
       nil
     end
   end
 
   def save(request)
     raise ArgumentError, "PUT does not accept options" unless request.options.empty?
 
     response = do_request(request) do |request|
       http_put(request, Puppet::Network::HTTP::API::V1.indirection2uri(request), request.instance.render, headers.merge({ "Content-Type" => request.instance.mime }))
     end
 
     if is_http_200?(response)
       check_master_version(response)
       content_type, body = parse_response(response)
       deserialize_save(content_type, body)
     else
       nil
     end
   end
 
   # Encapsulate call to request.do_request with the arguments from this class
   # Then yield to the code block that was called in
   # We certainly could have retained the full request.do_request(...) { |r| ... }
   # but this makes the code much cleaner and we only then actually make the call
   # to request.do_request from here, thus if we change what we pass or how we
   # get it, we only need to change it here.
   def do_request(request)
     request.do_request(self.class.srv_service, self.class.server, self.class.port) { |request| yield(request) }
   end
 
   def validate_key(request)
     # Validation happens on the remote end
   end
 
   private
 
   def is_http_200?(response)
     case response.code
     when "404"
       false
     when /^2/
       true
     else
       # Raise the http error if we didn't get a 'success' of some kind.
       raise convert_to_http_error(response)
     end
   end
 
   def is_http_404?(response)
     response.code == "404"
   end
 
   def convert_to_http_error(response)
     message = "Error #{response.code} on SERVER: #{(response.body||'').empty? ? response.message : uncompress_body(response)}"
     Net::HTTPError.new(message, response)
   end
 
   def check_master_version response
     if !response[Puppet::Network::HTTP::HEADER_PUPPET_VERSION] &&
        (Puppet[:legacy_query_parameter_serialization] == false || Puppet[:report_serialization_format] != "yaml")
       Puppet.notice "Using less secure serialization of reports and query parameters for compatibility"
       Puppet.notice "with older puppet master. To remove this notice, please upgrade your master(s) "
       Puppet.notice "to Puppet 3.3 or newer."
       Puppet.notice "See http://links.puppetlabs.com/deprecate_yaml_on_network for more information."
       Puppet[:legacy_query_parameter_serialization] = true
       Puppet[:report_serialization_format] = "yaml"
     end
   end
 
   # Returns the content_type, stripping any appended charset, and the
   # body, decompressed if necessary (content-encoding is checked inside
   # uncompress_body)
   def parse_response(response)
     if response['content-type']
       [ response['content-type'].gsub(/\s*;.*$/,''),
         body = uncompress_body(response) ]
     else
       raise "No content type in http response; cannot parse"
     end
   end
 
   def deserialize_find(content_type, body)
     model.convert_from(content_type, body)
   end
 
   def deserialize_search(content_type, body)
     model.convert_from_multiple(content_type, body)
   end
 
   def deserialize_destroy(content_type, body)
     model.convert_from(content_type, body)
   end
 
   def deserialize_save(content_type, body)
     nil
   end
 
   def environment
     Puppet.lookup(:environments).get(Puppet[:environment])
   end
 end
diff --git a/lib/puppet/ssl/host.rb b/lib/puppet/ssl/host.rb
index e78ca9a61..566ec18f5 100644
--- a/lib/puppet/ssl/host.rb
+++ b/lib/puppet/ssl/host.rb
@@ -1,371 +1,371 @@
 require 'puppet/indirector'
 require 'puppet/ssl'
 require 'puppet/ssl/key'
 require 'puppet/ssl/certificate'
 require 'puppet/ssl/certificate_request'
 require 'puppet/ssl/certificate_revocation_list'
 require 'puppet/ssl/certificate_request_attributes'
 
 # The class that manages all aspects of our SSL certificates --
 # private keys, public keys, requests, etc.
 class Puppet::SSL::Host
   # Yay, ruby's strange constant lookups.
   Key = Puppet::SSL::Key
   CA_NAME = Puppet::SSL::CA_NAME
   Certificate = Puppet::SSL::Certificate
   CertificateRequest = Puppet::SSL::CertificateRequest
   CertificateRevocationList = Puppet::SSL::CertificateRevocationList
 
   extend Puppet::Indirector
   indirects :certificate_status, :terminus_class => :file, :doc => <<DOC
     This indirection represents the host that ties a key, certificate, and certificate request together.
     The indirection key is the certificate CN (generally a hostname).
 DOC
 
   attr_reader :name
   attr_accessor :ca
 
   attr_writer :key, :certificate, :certificate_request
 
   # This accessor is used in instances for indirector requests to hold desired state
   attr_accessor :desired_state
 
   def self.localhost
     return @localhost if @localhost
     @localhost = new
     @localhost.generate unless @localhost.certificate
     @localhost.key
     @localhost
   end
 
   def self.reset
     @localhost = nil
   end
 
   # This is the constant that people will use to mark that a given host is
   # a certificate authority.
   def self.ca_name
     CA_NAME
   end
 
   class << self
     attr_reader :ca_location
   end
 
   # Configure how our various classes interact with their various terminuses.
   def self.configure_indirection(terminus, cache = nil)
     Certificate.indirection.terminus_class = terminus
     CertificateRequest.indirection.terminus_class = terminus
     CertificateRevocationList.indirection.terminus_class = terminus
 
     host_map = {:ca => :file, :disabled_ca => nil, :file => nil, :rest => :rest}
     if term = host_map[terminus]
       self.indirection.terminus_class = term
     else
       self.indirection.reset_terminus_class
     end
 
     if cache
       # This is weird; we don't actually cache our keys, we
       # use what would otherwise be the cache as our normal
       # terminus.
       Key.indirection.terminus_class = cache
     else
       Key.indirection.terminus_class = terminus
     end
 
     if cache
       Certificate.indirection.cache_class = cache
       CertificateRequest.indirection.cache_class = cache
       CertificateRevocationList.indirection.cache_class = cache
     else
       # Make sure we have no cache configured.  puppet master
       # switches the configurations around a bit, so it's important
       # that we specify the configs for absolutely everything, every
       # time.
       Certificate.indirection.cache_class = nil
       CertificateRequest.indirection.cache_class = nil
       CertificateRevocationList.indirection.cache_class = nil
     end
   end
 
   CA_MODES = {
     # Our ca is local, so we use it as the ultimate source of information
     # And we cache files locally.
     :local => [:ca, :file],
     # We're a remote CA client.
     :remote => [:rest, :file],
     # We are the CA, so we don't have read/write access to the normal certificates.
     :only => [:ca],
     # We have no CA, so we just look in the local file store.
     :none => [:disabled_ca]
   }
 
   # Specify how we expect to interact with our certificate authority.
   def self.ca_location=(mode)
     modes = CA_MODES.collect { |m, vals| m.to_s }.join(", ")
     raise ArgumentError, "CA Mode can only be one of: #{modes}" unless CA_MODES.include?(mode)
 
     @ca_location = mode
 
     configure_indirection(*CA_MODES[@ca_location])
   end
 
   # Puppet::SSL::Host is actually indirected now so the original implementation
   # has been moved into the certificate_status indirector.  This method is in-use
   # in `puppet cert -c <certname>`.
   def self.destroy(name)
     indirection.destroy(name)
   end
 
   def self.from_data_hash(data)
     instance = new(data["name"])
     if data["desired_state"]
       instance.desired_state = data["desired_state"]
     end
     instance
   end
 
   def self.from_pson(pson)
     Puppet.deprecation_warning("from_pson is being removed in favour of from_data_hash.")
     self.from_data_hash(pson)
   end
 
   # Puppet::SSL::Host is actually indirected now so the original implementation
   # has been moved into the certificate_status indirector.  This method does not
   # appear to be in use in `puppet cert -l`.
   def self.search(options = {})
     indirection.search("*", options)
   end
 
   # Is this a ca host, meaning that all of its files go in the CA location?
   def ca?
     ca
   end
 
   def key
     @key ||= Key.indirection.find(name)
   end
 
   # This is the private key; we can create it from scratch
   # with no inputs.
   def generate_key
     @key = Key.new(name)
     @key.generate
     begin
       Key.indirection.save(@key)
     rescue
       @key = nil
       raise
     end
     true
   end
 
   def certificate_request
     @certificate_request ||= CertificateRequest.indirection.find(name)
   end
 
   # Our certificate request requires the key but that's all.
   def generate_certificate_request(options = {})
     generate_key unless key
 
     # If this CSR is for the current machine...
     if name == Puppet[:certname].downcase
       # ...add our configured dns_alt_names
       if Puppet[:dns_alt_names] and Puppet[:dns_alt_names] != ''
         options[:dns_alt_names] ||= Puppet[:dns_alt_names]
       elsif Puppet::SSL::CertificateAuthority.ca? and fqdn = Facter.value(:fqdn) and domain = Facter.value(:domain)
         options[:dns_alt_names] = "puppet, #{fqdn}, puppet.#{domain}"
       end
     end
 
     csr_attributes = Puppet::SSL::CertificateRequestAttributes.new(Puppet[:csr_attributes])
     if csr_attributes.load
       options[:csr_attributes] = csr_attributes.custom_attributes
       options[:extension_requests] = csr_attributes.extension_requests
     end
 
     @certificate_request = CertificateRequest.new(name)
     @certificate_request.generate(key.content, options)
     begin
       CertificateRequest.indirection.save(@certificate_request)
     rescue
       @certificate_request = nil
       raise
     end
 
     true
   end
 
   def certificate
     unless @certificate
       generate_key unless key
 
       # get the CA cert first, since it's required for the normal cert
       # to be of any use.
-      return nil unless Certificate.indirection.find("ca") unless ca?
+      return nil unless Certificate.indirection.find("ca", :fail_on_404 => true) unless ca?
       return nil unless @certificate = Certificate.indirection.find(name)
 
       validate_certificate_with_key
     end
     @certificate
   end
 
   def validate_certificate_with_key
     raise Puppet::Error, "No certificate to validate." unless certificate
     raise Puppet::Error, "No private key with which to validate certificate with fingerprint: #{certificate.fingerprint}" unless key
     unless certificate.content.check_private_key(key.content)
       raise Puppet::Error, <<ERROR_STRING
 The certificate retrieved from the master does not match the agent's private key.
 Certificate fingerprint: #{certificate.fingerprint}
 To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certficate.
 On the master:
   puppet cert clean #{Puppet[:certname]}
 On the agent:
   rm -f #{Puppet[:hostcert]}
   puppet agent -t
 ERROR_STRING
     end
   end
 
   # Generate all necessary parts of our ssl host.
   def generate
     generate_key unless key
     generate_certificate_request unless certificate_request
 
     # If we can get a CA instance, then we're a valid CA, and we
     # should use it to sign our request; else, just try to read
     # the cert.
     if ! certificate and ca = Puppet::SSL::CertificateAuthority.instance
       ca.sign(self.name, true)
     end
   end
 
   def initialize(name = nil)
     @name = (name || Puppet[:certname]).downcase
     Puppet::SSL::Base.validate_certname(@name)
     @key = @certificate = @certificate_request = nil
     @ca = (name == self.class.ca_name)
   end
 
   # Extract the public key from the private key.
   def public_key
     key.content.public_key
   end
 
   # Create/return a store that uses our SSL info to validate
   # connections.
   def ssl_store(purpose = OpenSSL::X509::PURPOSE_ANY)
     unless @ssl_store
       @ssl_store = OpenSSL::X509::Store.new
       @ssl_store.purpose = purpose
 
       # Use the file path here, because we don't want to cause
       # a lookup in the middle of setting our ssl connection.
       @ssl_store.add_file(Puppet[:localcacert])
 
       # If we're doing revocation and there's a CRL, add it to our store.
       if Puppet.settings[:certificate_revocation]
         if crl = Puppet::SSL::CertificateRevocationList.indirection.find(CA_NAME)
           @ssl_store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK
           @ssl_store.add_crl(crl.content)
         end
       end
       return @ssl_store
     end
     @ssl_store
   end
 
   def to_data_hash
     my_cert = Puppet::SSL::Certificate.indirection.find(name)
     result = { :name  => name }
 
     my_state = state
 
     result[:state] = my_state
     result[:desired_state] = desired_state if desired_state
 
     thing_to_use = (my_state == 'requested') ? certificate_request : my_cert
 
     # this is for backwards-compatibility
     # we should deprecate it and transition people to using
     # pson[:fingerprints][:default]
     # It appears that we have no internal consumers of this api
     # --jeffweiss 30 aug 2012
     result[:fingerprint] = thing_to_use.fingerprint
 
     # The above fingerprint doesn't tell us what message digest algorithm was used
     # No problem, except that the default is changing between 2.7 and 3.0. Also, as
     # we move to FIPS 140-2 compliance, MD5 is no longer allowed (and, gasp, will
     # segfault in rubies older than 1.9.3)
     # So, when we add the newer fingerprints, we're explicit about the hashing
     # algorithm used.
     # --jeffweiss 31 july 2012
     result[:fingerprints] = {}
     result[:fingerprints][:default] = thing_to_use.fingerprint
 
     suitable_message_digest_algorithms.each do |md|
       result[:fingerprints][md] = thing_to_use.fingerprint md
     end
     result[:dns_alt_names] = thing_to_use.subject_alt_names
 
     result
   end
 
   # eventually we'll probably want to move this somewhere else or make it
   # configurable
   # --jeffweiss 29 aug 2012
   def suitable_message_digest_algorithms
     [:SHA1, :SHA256, :SHA512]
   end
 
   # Attempt to retrieve a cert, if we don't already have one.
   def wait_for_cert(time)
     begin
       return if certificate
       generate
       return if certificate
     rescue SystemExit,NoMemoryError
       raise
     rescue Exception => detail
       Puppet.log_exception(detail, "Could not request certificate: #{detail.message}")
       if time < 1
         puts "Exiting; failed to retrieve certificate and waitforcert is disabled"
         exit(1)
       else
         sleep(time)
       end
       retry
     end
 
     if time < 1
       puts "Exiting; no certificate found and waitforcert is disabled"
       exit(1)
     end
 
     while true
       sleep time
       begin
         break if certificate
         Puppet.notice "Did not receive certificate"
       rescue StandardError => detail
         Puppet.log_exception(detail, "Could not request certificate: #{detail.message}")
       end
     end
   end
 
   def state
     if certificate_request
       return 'requested'
     end
 
     begin
       Puppet::SSL::CertificateAuthority.new.verify(name)
       return 'signed'
     rescue Puppet::SSL::CertificateAuthority::CertificateVerificationError
       return 'revoked'
     end
   end
 end
 
 require 'puppet/ssl/certificate_authority'
diff --git a/spec/unit/indirector/rest_spec.rb b/spec/unit/indirector/rest_spec.rb
index 1ba2b2c62..5c9065fec 100755
--- a/spec/unit/indirector/rest_spec.rb
+++ b/spec/unit/indirector/rest_spec.rb
@@ -1,545 +1,559 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
 require 'puppet/indirector'
 require 'puppet/indirector/errors'
 require 'puppet/indirector/rest'
 
 HTTP_ERROR_CODES = [300, 400, 500]
 
 # Just one from each category since the code makes no real distinctions
 shared_examples_for "a REST terminus method" do |terminus_method|
   describe "when talking to an older master" do
     it "should set backward compatibility settings" do
       response.stubs(:[]).with(Puppet::Network::HTTP::HEADER_PUPPET_VERSION).returns nil
 
       terminus.send(terminus_method, request)
       Puppet[:report_serialization_format].should == 'yaml'
       Puppet[:legacy_query_parameter_serialization].should == true
     end
   end
 
   describe "when talking to a 3.3.1 master" do
     it "should not set backward compatibility settings" do
       response.stubs(:[]).with(Puppet::Network::HTTP::HEADER_PUPPET_VERSION).returns "3.3.1"
 
       terminus.send(terminus_method, request)
       Puppet[:report_serialization_format].should == 'pson'
       Puppet[:legacy_query_parameter_serialization].should == false
     end
   end
 
   HTTP_ERROR_CODES.each do |code|
     describe "when the response code is #{code}" do
       let(:response) { mock_response(code, 'error messaged!!!') }
 
       it "raises an http error with the body of the response" do
         expect {
           terminus.send(terminus_method, request)
         }.to raise_error(Net::HTTPError, "Error #{code} on SERVER: #{response.body}")
       end
 
       it "does not attempt to deserialize the response" do
         model.expects(:convert_from).never
 
         expect {
           terminus.send(terminus_method, request)
         }.to raise_error(Net::HTTPError)
       end
 
       # I'm not sure what this means or if it's used
       it "if the body is empty raises an http error with the response header" do
         response.stubs(:body).returns ""
         response.stubs(:message).returns "fhqwhgads"
 
         expect {
           terminus.send(terminus_method, request)
         }.to raise_error(Net::HTTPError, "Error #{code} on SERVER: #{response.message}")
       end
 
       describe "and the body is compressed" do
         it "raises an http error with the decompressed body of the response" do
           uncompressed_body = "why"
           compressed_body = Zlib::Deflate.deflate(uncompressed_body)
 
           response = mock_response(code, compressed_body, 'text/plain', 'deflate')
           connection.expects(http_method).returns(response)
 
           expect {
             terminus.send(terminus_method, request)
           }.to raise_error(Net::HTTPError, "Error #{code} on SERVER: #{uncompressed_body}")
         end
       end
     end
   end
 end
 
 shared_examples_for "a deserializing terminus method" do |terminus_method|
   describe "when the response has no content-type" do
     let(:response) { mock_response(200, "body", nil, nil) }
     it "raises an error" do
       expect {
         terminus.send(terminus_method, request)
       }.to raise_error(RuntimeError, "No content type in http response; cannot parse")
     end
   end
 
   it "doesn't catch errors in deserialization" do
     model.expects(:convert_from).raises(Puppet::Error, "Whoa there")
 
     expect { terminus.send(terminus_method, request) }.to raise_error(Puppet::Error, "Whoa there")
   end
 end
 
 describe Puppet::Indirector::REST do
   before :all do
     class Puppet::TestModel
       extend Puppet::Indirector
       indirects :test_model
       attr_accessor :name, :data
       def initialize(name = "name", data = '')
         @name = name
         @data = data
       end
 
       def self.convert_from(format, string)
         new('', string)
       end
 
       def self.convert_from_multiple(format, string)
         string.split(',').collect { |s| convert_from(format, s) }
       end
 
       def to_data_hash
         { 'name' => @name, 'data' => @data }
       end
 
       def ==(other)
         other.is_a? Puppet::TestModel and other.name == name and other.data == data
       end
     end
 
     # The subclass must not be all caps even though the superclass is
     class Puppet::TestModel::Rest < Puppet::Indirector::REST
     end
 
     Puppet::TestModel.indirection.terminus_class = :rest
   end
 
   after :all do
     Puppet::TestModel.indirection.delete
     # Remove the class, unlinking it from the rest of the system.
     Puppet.send(:remove_const, :TestModel)
   end
 
   let(:terminus_class) { Puppet::TestModel::Rest }
   let(:terminus) { Puppet::TestModel.indirection.terminus(:rest) }
   let(:indirection) { Puppet::TestModel.indirection }
   let(:model) { Puppet::TestModel }
 
   def mock_response(code, body, content_type='text/plain', encoding=nil)
     obj = stub('http 200 ok', :code => code.to_s, :body => body)
     obj.stubs(:[]).with('content-type').returns(content_type)
     obj.stubs(:[]).with('content-encoding').returns(encoding)
     obj.stubs(:[]).with(Puppet::Network::HTTP::HEADER_PUPPET_VERSION).returns(Puppet.version)
     obj
   end
 
   def find_request(key, options={})
     Puppet::Indirector::Request.new(:test_model, :find, key, nil, options)
   end
 
   def head_request(key, options={})
     Puppet::Indirector::Request.new(:test_model, :head, key, nil, options)
   end
 
   def search_request(key, options={})
     Puppet::Indirector::Request.new(:test_model, :search, key, nil, options)
   end
 
   def delete_request(key, options={})
     Puppet::Indirector::Request.new(:test_model, :destroy, key, nil, options)
   end
 
   def save_request(key, instance, options={})
     Puppet::Indirector::Request.new(:test_model, :save, key, instance, options)
   end
 
   it "should have a method for specifying what setting a subclass should use to retrieve its server" do
     terminus_class.should respond_to(:use_server_setting)
   end
 
   it "should use any specified setting to pick the server" do
     terminus_class.expects(:server_setting).returns :inventory_server
     Puppet[:inventory_server] = "myserver"
     terminus_class.server.should == "myserver"
   end
 
   it "should default to :server for the server setting" do
     terminus_class.expects(:server_setting).returns nil
     Puppet[:server] = "myserver"
     terminus_class.server.should == "myserver"
   end
 
   it "should have a method for specifying what setting a subclass should use to retrieve its port" do
     terminus_class.should respond_to(:use_port_setting)
   end
 
   it "should use any specified setting to pick the port" do
     terminus_class.expects(:port_setting).returns :ca_port
     Puppet[:ca_port] = "321"
     terminus_class.port.should == 321
   end
 
   it "should default to :port for the port setting" do
     terminus_class.expects(:port_setting).returns nil
     Puppet[:masterport] = "543"
     terminus_class.port.should == 543
   end
 
   it 'should default to :puppet for the srv_service' do
     Puppet::Indirector::REST.srv_service.should == :puppet
   end
 
   describe "when creating an HTTP client" do
     it "should use the class's server and port if the indirection request provides neither" do
       @request = stub 'request', :key => "foo", :server => nil, :port => nil
       terminus.class.expects(:port).returns 321
       terminus.class.expects(:server).returns "myserver"
       Puppet::Network::HttpPool.expects(:http_instance).with("myserver", 321).returns "myconn"
       terminus.network(@request).should == "myconn"
     end
 
     it "should use the server from the indirection request if one is present" do
       @request = stub 'request', :key => "foo", :server => "myserver", :port => nil
       terminus.class.stubs(:port).returns 321
       Puppet::Network::HttpPool.expects(:http_instance).with("myserver", 321).returns "myconn"
       terminus.network(@request).should == "myconn"
     end
 
     it "should use the port from the indirection request if one is present" do
       @request = stub 'request', :key => "foo", :server => nil, :port => 321
       terminus.class.stubs(:server).returns "myserver"
       Puppet::Network::HttpPool.expects(:http_instance).with("myserver", 321).returns "myconn"
       terminus.network(@request).should == "myconn"
     end
   end
 
   describe "#find" do
     let(:http_method) { :get }
     let(:response) { mock_response(200, 'body') }
     let(:connection) { stub('mock http connection', :get => response, :verify_callback= => nil) }
     let(:request) { find_request('foo') }
 
     before :each do
       terminus.stubs(:network).returns(connection)
     end
 
     it_behaves_like 'a REST terminus method', :find
     it_behaves_like 'a deserializing terminus method', :find
 
     describe "with a long set of parameters" do
       it "calls post on the connection with the query params in the body" do
         params = {}
         'aa'.upto('zz') do |s|
           params[s] = 'foo'
         end
 
         # The request special-cases this parameter, and it
         # won't be passed on to the server, so we remove it here
         # to avoid a failure.
         params.delete('ip')
 
         request = find_request('whoa', params)
 
         connection.expects(:post).with do |uri, body|
           body.split("&").sort == params.map {|key,value| "#{key}=#{value}"}.sort
         end.returns(mock_response(200, 'body'))
 
         terminus.find(request)
       end
     end
 
     describe "with no parameters" do
       it "calls get on the connection" do
         request = find_request('foo bar')
 
         connection.expects(:get).with('/production/test_model/foo%20bar?', anything).returns(mock_response('200', 'response body'))
 
         terminus.find(request).should == model.new('foo bar', 'response body')
       end
     end
 
     it "returns nil on 404" do
       response = mock_response('404', nil)
 
       connection.expects(:get).returns(response)
 
       terminus.find(request).should == nil
     end
 
-    it 'raises a warning for a 404' do
+    it 'raises no warning for a 404 (when not asked to do so)' do
       response = mock_response('404', 'this is the notfound you are looking for')
       connection.expects(:get).returns(response)
       expected_message = 'Find /production/test_model/foo? resulted in 404 with the message: this is the notfound you are looking for'
-      Puppet::Util::Warnings.expects(:maybe_log).with(expected_message, Puppet::TestModel::Rest)
-      terminus.find(request)
+      expect{terminus.find(request)}.to_not raise_error()
+    end
+
+    context 'when fail_on_404 is used in request' do
+      let(:request) { find_request('foo', :fail_on_404 => true) }
+
+      it 'raises an error for a 404 when asked to do so' do
+        response = mock_response('404', 'this is the notfound you are looking for')
+        connection.expects(:get).returns(response)
+        expected_message = [
+          'Find /production/test_model/foo?fail_on_404=true',
+          'resulted in 404 with the message: this is the notfound you are looking for'].join( ' ')
+        expect do
+          terminus.find(request)
+        end.to raise_error(Puppet::Error, expected_message)
+      end
     end
 
     it "asks the model to deserialize the response body and sets the name on the resulting object to the find key" do
       connection.expects(:get).returns response
 
       model.expects(:convert_from).with(response['content-type'], response.body).returns(
         model.new('overwritten', 'decoded body')
       )
 
       terminus.find(request).should == model.new('foo', 'decoded body')
     end
 
     it "doesn't require the model to support name=" do
       connection.expects(:get).returns response
       instance = model.new('name', 'decoded body')
 
       model.expects(:convert_from).with(response['content-type'], response.body).returns(instance)
       instance.expects(:respond_to?).with(:name=).returns(false)
       instance.expects(:name=).never
 
       terminus.find(request).should == model.new('name', 'decoded body')
     end
 
     it "provides an Accept header containing the list of supported formats joined with commas" do
       connection.expects(:get).with(anything, has_entry("Accept" => "supported, formats")).returns(response)
 
       terminus.model.expects(:supported_formats).returns %w{supported formats}
       terminus.find(request)
     end
 
     it "adds an Accept-Encoding header" do
       terminus.expects(:add_accept_encoding).returns({"accept-encoding" => "gzip"})
 
       connection.expects(:get).with(anything, has_entry("accept-encoding" => "gzip")).returns(response)
 
       terminus.find(request)
     end
 
     it "uses only the mime-type from the content-type header when asking the model to deserialize" do
       response = mock_response('200', 'mydata', "text/plain; charset=utf-8")
       connection.expects(:get).returns(response)
 
       model.expects(:convert_from).with("text/plain", "mydata").returns "myobject"
 
       terminus.find(request).should == "myobject"
     end
 
     it "decompresses the body before passing it to the model for deserialization" do
       uncompressed_body = "Why hello there"
       compressed_body = Zlib::Deflate.deflate(uncompressed_body)
 
       response = mock_response('200', compressed_body, 'text/plain', 'deflate')
       connection.expects(:get).returns(response)
 
       model.expects(:convert_from).with("text/plain", uncompressed_body).returns "myobject"
 
       terminus.find(request).should == "myobject"
     end
   end
 
   describe "#head" do
     let(:http_method) { :head }
     let(:response) { mock_response(200, nil) }
     let(:connection) { stub('mock http connection', :head => response, :verify_callback= => nil) }
     let(:request) { head_request('foo') }
 
     before :each do
       terminus.stubs(:network).returns(connection)
     end
 
     it_behaves_like 'a REST terminus method', :head
 
     it "returns true if there was a successful http response" do
       connection.expects(:head).returns mock_response('200', nil)
 
       terminus.head(request).should == true
     end
 
     it "returns false on a 404 response" do
       connection.expects(:head).returns mock_response('404', nil)
 
       terminus.head(request).should == false
     end
   end
 
   describe "#search" do
     let(:http_method) { :get }
     let(:response) { mock_response(200, 'data1,data2,data3') }
     let(:connection) { stub('mock http connection', :get => response, :verify_callback= => nil) }
     let(:request) { search_request('foo') }
 
     before :each do
       terminus.stubs(:network).returns(connection)
     end
 
     it_behaves_like 'a REST terminus method', :search
     it_behaves_like 'a deserializing terminus method', :search
 
     it "should call the GET http method on a network connection" do
       connection.expects(:get).with('/production/test_models/foo', has_key('Accept')).returns mock_response(200, 'data3, data4')
 
       terminus.search(request)
     end
 
     it "returns an empty list on 404" do
       response = mock_response('404', nil)
 
       connection.expects(:get).returns(response)
 
       terminus.search(request).should == []
     end
 
     it "asks the model to deserialize the response body into multiple instances" do
       terminus.search(request).should == [model.new('', 'data1'), model.new('', 'data2'), model.new('', 'data3')]
     end
 
     it "should provide an Accept header containing the list of supported formats joined with commas" do
       connection.expects(:get).with(anything, has_entry("Accept" => "supported, formats")).returns(mock_response(200, ''))
 
       terminus.model.expects(:supported_formats).returns %w{supported formats}
       terminus.search(request)
     end
 
     it "should return an empty array if serialization returns nil" do
       model.stubs(:convert_from_multiple).returns nil
 
       terminus.search(request).should == []
     end
   end
 
   describe "#destroy" do
     let(:http_method) { :delete }
     let(:response) { mock_response(200, 'body') }
     let(:connection) { stub('mock http connection', :delete => response, :verify_callback= => nil) }
     let(:request) { delete_request('foo') }
 
     before :each do
       terminus.stubs(:network).returns(connection)
     end
 
     it_behaves_like 'a REST terminus method', :destroy
     it_behaves_like 'a deserializing terminus method', :destroy
 
     it "should call the DELETE http method on a network connection" do
       connection.expects(:delete).with('/production/test_model/foo', has_key('Accept')).returns(response)
 
       terminus.destroy(request)
     end
 
     it "should fail if any options are provided, since DELETE apparently does not support query options" do
       request = delete_request('foo', :one => "two", :three => "four")
 
       expect { terminus.destroy(request) }.to raise_error(ArgumentError)
     end
 
     it "should deserialize and return the http response" do
       connection.expects(:delete).returns response
 
       terminus.destroy(request).should == model.new('', 'body')
     end
 
     it "returns nil on 404" do
       response = mock_response('404', nil)
 
       connection.expects(:delete).returns(response)
 
       terminus.destroy(request).should == nil
     end
 
     it "should provide an Accept header containing the list of supported formats joined with commas" do
       connection.expects(:delete).with(anything, has_entry("Accept" => "supported, formats")).returns(response)
 
       terminus.model.expects(:supported_formats).returns %w{supported formats}
       terminus.destroy(request)
     end
   end
 
   describe "#save" do
     let(:http_method) { :put }
     let(:response) { mock_response(200, 'body') }
     let(:connection) { stub('mock http connection', :put => response, :verify_callback= => nil) }
     let(:instance) { model.new('the thing', 'some contents') }
     let(:request) { save_request(instance.name, instance) }
 
     before :each do
       terminus.stubs(:network).returns(connection)
     end
 
     it_behaves_like 'a REST terminus method', :save
 
     it "should call the PUT http method on a network connection" do
       connection.expects(:put).with('/production/test_model/the%20thing', anything, has_key("Content-Type")).returns response
 
       terminus.save(request)
     end
 
     it "should fail if any options are provided, since PUT apparently does not support query options" do
       request = save_request(instance.name, instance, :one => "two", :three => "four")
 
       expect { terminus.save(request) }.to raise_error(ArgumentError)
     end
 
     it "should serialize the instance using the default format and pass the result as the body of the request" do
       instance.expects(:render).returns "serial_instance"
       connection.expects(:put).with(anything, "serial_instance", anything).returns response
 
       terminus.save(request)
     end
 
     it "returns nil on 404" do
       response = mock_response('404', nil)
 
       connection.expects(:put).returns(response)
 
       terminus.save(request).should == nil
     end
 
     it "returns nil" do
       connection.expects(:put).returns response
 
       terminus.save(request).should be_nil
     end
 
     it "should provide an Accept header containing the list of supported formats joined with commas" do
       connection.expects(:put).with(anything, anything, has_entry("Accept" => "supported, formats")).returns(response)
 
       instance.expects(:render).returns('')
       model.expects(:supported_formats).returns %w{supported formats}
       instance.expects(:mime).returns "supported"
 
       terminus.save(request)
     end
 
     it "should provide a Content-Type header containing the mime-type of the sent object" do
       instance.expects(:mime).returns "mime"
       connection.expects(:put).with(anything, anything, has_entry('Content-Type' => "mime")).returns(response)
 
       terminus.save(request)
     end
   end
 
   context 'dealing with SRV settings' do
     [
       :destroy,
       :find,
       :head,
       :save,
       :search
     ].each do |method|
       it "##{method} passes the SRV service, and fall-back server & port to the request's do_request method" do
         request = Puppet::Indirector::Request.new(:indirection, method, 'key', nil)
         stub_response = mock_response('200', 'body')
 
         request.expects(:do_request).with(terminus.class.srv_service, terminus.class.server, terminus.class.port).returns(stub_response)
 
         terminus.send(method, request)
       end
     end
   end
 end
diff --git a/spec/unit/ssl/host_spec.rb b/spec/unit/ssl/host_spec.rb
index a80fe9205..280880d1b 100755
--- a/spec/unit/ssl/host_spec.rb
+++ b/spec/unit/ssl/host_spec.rb
@@ -1,940 +1,940 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
 
 require 'puppet/ssl/host'
 require 'matchers/json'
 
 def base_pson_comparison(result, pson_hash)
   result["fingerprint"].should == pson_hash["fingerprint"]
   result["name"].should        == pson_hash["name"]
   result["state"].should       == pson_hash["desired_state"]
 end
 
 describe Puppet::SSL::Host do
   include JSONMatchers
   include PuppetSpec::Files
 
   before do
     Puppet::SSL::Host.indirection.terminus_class = :file
 
     # Get a safe temporary file
     dir = tmpdir("ssl_host_testing")
     Puppet.settings[:confdir] = dir
     Puppet.settings[:vardir] = dir
     Puppet.settings.use :main, :ssl
 
     @host = Puppet::SSL::Host.new("myname")
   end
 
   after do
     # Cleaned out any cached localhost instance.
     Puppet::SSL::Host.reset
     Puppet::SSL::Host.ca_location = :none
   end
 
   it "should use any provided name as its name" do
     @host.name.should == "myname"
   end
 
   it "should retrieve its public key from its private key" do
     realkey = mock 'realkey'
     key = stub 'key', :content => realkey
     Puppet::SSL::Key.indirection.stubs(:find).returns(key)
     pubkey = mock 'public_key'
     realkey.expects(:public_key).returns pubkey
 
     @host.public_key.should equal(pubkey)
   end
 
   it "should default to being a non-ca host" do
     @host.ca?.should be_false
   end
 
   it "should be a ca host if its name matches the CA_NAME" do
     Puppet::SSL::Host.stubs(:ca_name).returns "yayca"
     Puppet::SSL::Host.new("yayca").should be_ca
   end
 
   it "should have a method for determining the CA location" do
     Puppet::SSL::Host.should respond_to(:ca_location)
   end
 
   it "should have a method for specifying the CA location" do
     Puppet::SSL::Host.should respond_to(:ca_location=)
   end
 
   it "should have a method for retrieving the default ssl host" do
     Puppet::SSL::Host.should respond_to(:ca_location=)
   end
 
   it "should have a method for producing an instance to manage the local host's keys" do
     Puppet::SSL::Host.should respond_to(:localhost)
   end
 
   it "should allow to reset localhost" do
     previous_host = Puppet::SSL::Host.localhost
     Puppet::SSL::Host.reset
     Puppet::SSL::Host.localhost.should_not == previous_host
   end
 
   it "should generate the certificate for the localhost instance if no certificate is available" do
     host = stub 'host', :key => nil
     Puppet::SSL::Host.expects(:new).returns host
 
     host.expects(:certificate).returns nil
     host.expects(:generate)
 
     Puppet::SSL::Host.localhost.should equal(host)
   end
 
   it "should create a localhost cert if no cert is available and it is a CA with autosign and it is using DNS alt names", :unless => Puppet.features.microsoft_windows? do
     Puppet[:autosign] = true
     Puppet[:confdir] = tmpdir('conf')
     Puppet[:dns_alt_names] = "foo,bar,baz"
     ca = Puppet::SSL::CertificateAuthority.new
     Puppet::SSL::CertificateAuthority.stubs(:instance).returns ca
 
     localhost = Puppet::SSL::Host.localhost
     cert = localhost.certificate
 
     cert.should be_a(Puppet::SSL::Certificate)
     cert.subject_alt_names.should =~ %W[DNS:#{Puppet[:certname]} DNS:foo DNS:bar DNS:baz]
   end
 
   context "with dns_alt_names" do
     before :each do
       @key = stub('key content')
       key = stub('key', :generate => true, :content => @key)
       Puppet::SSL::Key.stubs(:new).returns key
       Puppet::SSL::Key.indirection.stubs(:save).with(key)
 
       @cr = stub('certificate request')
       Puppet::SSL::CertificateRequest.stubs(:new).returns @cr
       Puppet::SSL::CertificateRequest.indirection.stubs(:save).with(@cr)
     end
 
     describe "explicitly specified" do
       before :each do
         Puppet[:dns_alt_names] = 'one, two'
       end
 
       it "should not include subjectAltName if not the local node" do
         @cr.expects(:generate).with(@key, {})
 
         Puppet::SSL::Host.new('not-the-' + Puppet[:certname]).generate
       end
 
       it "should include subjectAltName if I am a CA" do
         @cr.expects(:generate).
           with(@key, { :dns_alt_names => Puppet[:dns_alt_names] })
 
         Puppet::SSL::Host.localhost
       end
     end
 
     describe "implicitly defaulted" do
       let(:ca) { stub('ca', :sign => nil) }
 
       before :each do
         Puppet[:dns_alt_names] = ''
 
         Puppet::SSL::CertificateAuthority.stubs(:instance).returns ca
       end
 
       it "should not include defaults if we're not the CA" do
         Puppet::SSL::CertificateAuthority.stubs(:ca?).returns false
 
         @cr.expects(:generate).with(@key, {})
 
         Puppet::SSL::Host.localhost
       end
 
       it "should not include defaults if not the local node" do
         Puppet::SSL::CertificateAuthority.stubs(:ca?).returns true
 
         @cr.expects(:generate).with(@key, {})
 
         Puppet::SSL::Host.new('not-the-' + Puppet[:certname]).generate
       end
 
       it "should not include defaults if we can't resolve our fqdn" do
         Puppet::SSL::CertificateAuthority.stubs(:ca?).returns true
         Facter.stubs(:value).with(:fqdn).returns nil
 
         @cr.expects(:generate).with(@key, {})
 
         Puppet::SSL::Host.localhost
       end
 
       it "should provide defaults if we're bootstrapping the local master" do
         Puppet::SSL::CertificateAuthority.stubs(:ca?).returns true
         Facter.stubs(:value).with(:fqdn).returns 'web.foo.com'
         Facter.stubs(:value).with(:domain).returns 'foo.com'
 
         @cr.expects(:generate).with(@key, {:dns_alt_names => "puppet, web.foo.com, puppet.foo.com"})
 
         Puppet::SSL::Host.localhost
       end
     end
   end
 
   it "should always read the key for the localhost instance in from disk" do
     host = stub 'host', :certificate => "eh"
     Puppet::SSL::Host.expects(:new).returns host
 
     host.expects(:key)
 
     Puppet::SSL::Host.localhost
   end
 
   it "should cache the localhost instance" do
     host = stub 'host', :certificate => "eh", :key => 'foo'
     Puppet::SSL::Host.expects(:new).once.returns host
     Puppet::SSL::Host.localhost.should == Puppet::SSL::Host.localhost
   end
 
   it "should be able to verify its certificate matches its key" do
     Puppet::SSL::Host.new("foo").should respond_to(:validate_certificate_with_key)
   end
 
   it "should consider the certificate invalid if it cannot find a key" do
     host = Puppet::SSL::Host.new("foo")
     certificate = mock('cert', :fingerprint => 'DEADBEEF')
     host.expects(:certificate).twice.returns certificate
     host.expects(:key).returns nil
     lambda { host.validate_certificate_with_key }.should raise_error(Puppet::Error, "No private key with which to validate certificate with fingerprint: DEADBEEF")
   end
 
   it "should consider the certificate invalid if it cannot find a certificate" do
     host = Puppet::SSL::Host.new("foo")
     host.expects(:key).never
     host.expects(:certificate).returns nil
     lambda { host.validate_certificate_with_key }.should raise_error(Puppet::Error, "No certificate to validate.")
   end
 
   it "should consider the certificate invalid if the SSL certificate's key verification fails" do
     host = Puppet::SSL::Host.new("foo")
     key = mock 'key', :content => "private_key"
     sslcert = mock 'sslcert'
     certificate = mock 'cert', {:content => sslcert, :fingerprint => 'DEADBEEF'}
     host.stubs(:key).returns key
     host.stubs(:certificate).returns certificate
     sslcert.expects(:check_private_key).with("private_key").returns false
     lambda { host.validate_certificate_with_key }.should raise_error(Puppet::Error, /DEADBEEF/)
   end
 
   it "should consider the certificate valid if the SSL certificate's key verification succeeds" do
     host = Puppet::SSL::Host.new("foo")
     key = mock 'key', :content => "private_key"
     sslcert = mock 'sslcert'
     certificate = mock 'cert', :content => sslcert
     host.stubs(:key).returns key
     host.stubs(:certificate).returns certificate
     sslcert.expects(:check_private_key).with("private_key").returns true
     lambda{ host.validate_certificate_with_key }.should_not raise_error
   end
 
   describe "when specifying the CA location" do
     it "should support the location ':local'" do
       lambda { Puppet::SSL::Host.ca_location = :local }.should_not raise_error
     end
 
     it "should support the location ':remote'" do
       lambda { Puppet::SSL::Host.ca_location = :remote }.should_not raise_error
     end
 
     it "should support the location ':none'" do
       lambda { Puppet::SSL::Host.ca_location = :none }.should_not raise_error
     end
 
     it "should support the location ':only'" do
       lambda { Puppet::SSL::Host.ca_location = :only }.should_not raise_error
     end
 
     it "should not support other modes" do
       lambda { Puppet::SSL::Host.ca_location = :whatever }.should raise_error(ArgumentError)
     end
 
     describe "as 'local'" do
       before do
         Puppet::SSL::Host.ca_location = :local
       end
 
       it "should set the cache class for Certificate, CertificateRevocationList, and CertificateRequest as :file" do
         Puppet::SSL::Certificate.indirection.cache_class.should == :file
         Puppet::SSL::CertificateRequest.indirection.cache_class.should == :file
         Puppet::SSL::CertificateRevocationList.indirection.cache_class.should == :file
       end
 
       it "should set the terminus class for Key and Host as :file" do
         Puppet::SSL::Key.indirection.terminus_class.should == :file
         Puppet::SSL::Host.indirection.terminus_class.should == :file
       end
 
       it "should set the terminus class for Certificate, CertificateRevocationList, and CertificateRequest as :ca" do
         Puppet::SSL::Certificate.indirection.terminus_class.should == :ca
         Puppet::SSL::CertificateRequest.indirection.terminus_class.should == :ca
         Puppet::SSL::CertificateRevocationList.indirection.terminus_class.should == :ca
       end
     end
 
     describe "as 'remote'" do
       before do
         Puppet::SSL::Host.ca_location = :remote
       end
 
       it "should set the cache class for Certificate, CertificateRevocationList, and CertificateRequest as :file" do
         Puppet::SSL::Certificate.indirection.cache_class.should == :file
         Puppet::SSL::CertificateRequest.indirection.cache_class.should == :file
         Puppet::SSL::CertificateRevocationList.indirection.cache_class.should == :file
       end
 
       it "should set the terminus class for Key as :file" do
         Puppet::SSL::Key.indirection.terminus_class.should == :file
       end
 
       it "should set the terminus class for Host, Certificate, CertificateRevocationList, and CertificateRequest as :rest" do
         Puppet::SSL::Host.indirection.terminus_class.should == :rest
         Puppet::SSL::Certificate.indirection.terminus_class.should == :rest
         Puppet::SSL::CertificateRequest.indirection.terminus_class.should == :rest
         Puppet::SSL::CertificateRevocationList.indirection.terminus_class.should == :rest
       end
     end
 
     describe "as 'only'" do
       before do
         Puppet::SSL::Host.ca_location = :only
       end
 
       it "should set the terminus class for Key, Certificate, CertificateRevocationList, and CertificateRequest as :ca" do
         Puppet::SSL::Key.indirection.terminus_class.should == :ca
         Puppet::SSL::Certificate.indirection.terminus_class.should == :ca
         Puppet::SSL::CertificateRequest.indirection.terminus_class.should == :ca
         Puppet::SSL::CertificateRevocationList.indirection.terminus_class.should == :ca
       end
 
       it "should set the cache class for Certificate, CertificateRevocationList, and CertificateRequest to nil" do
         Puppet::SSL::Certificate.indirection.cache_class.should be_nil
         Puppet::SSL::CertificateRequest.indirection.cache_class.should be_nil
         Puppet::SSL::CertificateRevocationList.indirection.cache_class.should be_nil
       end
 
       it "should set the terminus class for Host to :file" do
         Puppet::SSL::Host.indirection.terminus_class.should == :file
       end
     end
 
     describe "as 'none'" do
       before do
         Puppet::SSL::Host.ca_location = :none
       end
 
       it "should set the terminus class for Key, Certificate, CertificateRevocationList, and CertificateRequest as :file" do
         Puppet::SSL::Key.indirection.terminus_class.should == :disabled_ca
         Puppet::SSL::Certificate.indirection.terminus_class.should == :disabled_ca
         Puppet::SSL::CertificateRequest.indirection.terminus_class.should == :disabled_ca
         Puppet::SSL::CertificateRevocationList.indirection.terminus_class.should == :disabled_ca
       end
 
       it "should set the terminus class for Host to 'none'" do
         lambda { Puppet::SSL::Host.indirection.terminus_class }.should raise_error(Puppet::DevError)
       end
     end
   end
 
   it "should have a class method for destroying all files related to a given host" do
     Puppet::SSL::Host.should respond_to(:destroy)
   end
 
   describe "when destroying a host's SSL files" do
     before do
       Puppet::SSL::Key.indirection.stubs(:destroy).returns false
       Puppet::SSL::Certificate.indirection.stubs(:destroy).returns false
       Puppet::SSL::CertificateRequest.indirection.stubs(:destroy).returns false
     end
 
     it "should destroy its certificate, certificate request, and key" do
       Puppet::SSL::Key.indirection.expects(:destroy).with("myhost")
       Puppet::SSL::Certificate.indirection.expects(:destroy).with("myhost")
       Puppet::SSL::CertificateRequest.indirection.expects(:destroy).with("myhost")
 
       Puppet::SSL::Host.destroy("myhost")
     end
 
     it "should return true if any of the classes returned true" do
       Puppet::SSL::Certificate.indirection.expects(:destroy).with("myhost").returns true
 
       Puppet::SSL::Host.destroy("myhost").should be_true
     end
 
     it "should report that nothing was deleted if none of the classes returned true" do
       Puppet::SSL::Host.destroy("myhost").should == "Nothing was deleted"
     end
   end
 
   describe "when initializing" do
     it "should default its name to the :certname setting" do
       Puppet[:certname] = "myname"
 
       Puppet::SSL::Host.new.name.should == "myname"
     end
 
     it "should downcase a passed in name" do
       Puppet::SSL::Host.new("Host.Domain.Com").name.should == "host.domain.com"
     end
 
     it "should indicate that it is a CA host if its name matches the ca_name constant" do
       Puppet::SSL::Host.stubs(:ca_name).returns "myca"
       Puppet::SSL::Host.new("myca").should be_ca
     end
   end
 
   describe "when managing its private key" do
     before do
       @realkey = "mykey"
       @key = Puppet::SSL::Key.new("mykey")
       @key.content = @realkey
     end
 
     it "should return nil if the key is not set and cannot be found" do
       Puppet::SSL::Key.indirection.expects(:find).with("myname").returns(nil)
       @host.key.should be_nil
     end
 
     it "should find the key in the Key class and return the Puppet instance" do
       Puppet::SSL::Key.indirection.expects(:find).with("myname").returns(@key)
       @host.key.should equal(@key)
     end
 
     it "should be able to generate and save a new key" do
       Puppet::SSL::Key.expects(:new).with("myname").returns(@key)
 
       @key.expects(:generate)
       Puppet::SSL::Key.indirection.expects(:save)
 
       @host.generate_key.should be_true
       @host.key.should equal(@key)
     end
 
     it "should not retain keys that could not be saved" do
       Puppet::SSL::Key.expects(:new).with("myname").returns(@key)
 
       @key.stubs(:generate)
       Puppet::SSL::Key.indirection.expects(:save).raises "eh"
 
       lambda { @host.generate_key }.should raise_error
       @host.key.should be_nil
     end
 
     it "should return any previously found key without requerying" do
       Puppet::SSL::Key.indirection.expects(:find).with("myname").returns(@key).once
       @host.key.should equal(@key)
       @host.key.should equal(@key)
     end
   end
 
   describe "when managing its certificate request" do
     before do
       @realrequest = "real request"
       @request = Puppet::SSL::CertificateRequest.new("myname")
       @request.content = @realrequest
     end
 
     it "should return nil if the key is not set and cannot be found" do
       Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myname").returns(nil)
       @host.certificate_request.should be_nil
     end
 
     it "should find the request in the Key class and return it and return the Puppet SSL request" do
       Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myname").returns @request
 
       @host.certificate_request.should equal(@request)
     end
 
     it "should generate a new key when generating the cert request if no key exists" do
       Puppet::SSL::CertificateRequest.expects(:new).with("myname").returns @request
 
       key = stub 'key', :public_key => mock("public_key"), :content => "mycontent"
 
       @host.expects(:key).times(2).returns(nil).then.returns(key)
       @host.expects(:generate_key).returns(key)
 
       @request.stubs(:generate)
       Puppet::SSL::CertificateRequest.indirection.stubs(:save)
 
       @host.generate_certificate_request
     end
 
     it "should be able to generate and save a new request using the private key" do
       Puppet::SSL::CertificateRequest.expects(:new).with("myname").returns @request
 
       key = stub 'key', :public_key => mock("public_key"), :content => "mycontent"
       @host.stubs(:key).returns(key)
       @request.expects(:generate).with("mycontent", {})
       Puppet::SSL::CertificateRequest.indirection.expects(:save).with(@request)
 
       @host.generate_certificate_request.should be_true
       @host.certificate_request.should equal(@request)
     end
 
     it "should return any previously found request without requerying" do
       Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myname").returns(@request).once
 
       @host.certificate_request.should equal(@request)
       @host.certificate_request.should equal(@request)
     end
 
     it "should not keep its certificate request in memory if the request cannot be saved" do
       Puppet::SSL::CertificateRequest.expects(:new).with("myname").returns @request
 
       key = stub 'key', :public_key => mock("public_key"), :content => "mycontent"
       @host.stubs(:key).returns(key)
       @request.stubs(:generate)
       @request.stubs(:name).returns("myname")
       terminus = stub 'terminus'
       terminus.stubs(:validate)
       Puppet::SSL::CertificateRequest.indirection.expects(:prepare).returns(terminus)
       terminus.expects(:save).with { |req| req.instance == @request && req.key == "myname" }.raises "eh"
 
       lambda { @host.generate_certificate_request }.should raise_error
 
       @host.instance_eval { @certificate_request }.should be_nil
     end
   end
 
   describe "when managing its certificate" do
     before do
       @realcert = mock 'certificate'
       @cert = stub 'cert', :content => @realcert
       @host.stubs(:key).returns mock("key")
       @host.stubs(:validate_certificate_with_key)
     end
 
     it "should find the CA certificate if it does not have a certificate" do
-      Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME).returns mock("cacert")
+      Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME, :fail_on_404 => true).returns mock("cacert")
       Puppet::SSL::Certificate.indirection.stubs(:find).with("myname").returns @cert
       @host.certificate
     end
 
     it "should not find the CA certificate if it is the CA host" do
       @host.expects(:ca?).returns true
       Puppet::SSL::Certificate.indirection.stubs(:find)
-      Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME).never
+      Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME, :fail_on_404 => true).never
 
       @host.certificate
     end
 
     it "should return nil if it cannot find a CA certificate" do
-      Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME).returns nil
+      Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME, :fail_on_404 => true).returns nil
       Puppet::SSL::Certificate.indirection.expects(:find).with("myname").never
 
       @host.certificate.should be_nil
     end
 
     it "should find the key if it does not have one" do
       Puppet::SSL::Certificate.indirection.stubs(:find)
       @host.expects(:key).returns mock("key")
       @host.certificate
     end
 
     it "should generate the key if one cannot be found" do
       Puppet::SSL::Certificate.indirection.stubs(:find)
       @host.expects(:key).returns nil
       @host.expects(:generate_key)
       @host.certificate
     end
 
     it "should find the certificate in the Certificate class and return the Puppet certificate instance" do
-      Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME).returns mock("cacert")
+      Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME, :fail_on_404 => true).returns mock("cacert")
       Puppet::SSL::Certificate.indirection.expects(:find).with("myname").returns @cert
       @host.certificate.should equal(@cert)
     end
 
     it "should return any previously found certificate" do
-      Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME).returns mock("cacert")
+      Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME, :fail_on_404 => true).returns mock("cacert")
       Puppet::SSL::Certificate.indirection.expects(:find).with("myname").returns(@cert).once
 
       @host.certificate.should equal(@cert)
       @host.certificate.should equal(@cert)
     end
   end
 
   it "should have a method for listing certificate hosts" do
     Puppet::SSL::Host.should respond_to(:search)
   end
 
   describe "when listing certificate hosts" do
     it "should default to listing all clients with any file types" do
       Puppet::SSL::Key.indirection.expects(:search).returns []
       Puppet::SSL::Certificate.indirection.expects(:search).returns []
       Puppet::SSL::CertificateRequest.indirection.expects(:search).returns []
       Puppet::SSL::Host.search
     end
 
     it "should be able to list only clients with a key" do
       Puppet::SSL::Key.indirection.expects(:search).returns []
       Puppet::SSL::Certificate.indirection.expects(:search).never
       Puppet::SSL::CertificateRequest.indirection.expects(:search).never
       Puppet::SSL::Host.search :for => Puppet::SSL::Key
     end
 
     it "should be able to list only clients with a certificate" do
       Puppet::SSL::Key.indirection.expects(:search).never
       Puppet::SSL::Certificate.indirection.expects(:search).returns []
       Puppet::SSL::CertificateRequest.indirection.expects(:search).never
       Puppet::SSL::Host.search :for => Puppet::SSL::Certificate
     end
 
     it "should be able to list only clients with a certificate request" do
       Puppet::SSL::Key.indirection.expects(:search).never
       Puppet::SSL::Certificate.indirection.expects(:search).never
       Puppet::SSL::CertificateRequest.indirection.expects(:search).returns []
       Puppet::SSL::Host.search :for => Puppet::SSL::CertificateRequest
     end
 
     it "should return a Host instance created with the name of each found instance" do
       key  = stub 'key',  :name => "key",  :to_ary => nil
       cert = stub 'cert', :name => "cert", :to_ary => nil
       csr  = stub 'csr',  :name => "csr",  :to_ary => nil
 
       Puppet::SSL::Key.indirection.expects(:search).returns [key]
       Puppet::SSL::Certificate.indirection.expects(:search).returns [cert]
       Puppet::SSL::CertificateRequest.indirection.expects(:search).returns [csr]
 
       returned = []
       %w{key cert csr}.each do |name|
         result = mock(name)
         returned << result
         Puppet::SSL::Host.expects(:new).with(name).returns result
       end
 
       result = Puppet::SSL::Host.search
       returned.each do |r|
         result.should be_include(r)
       end
     end
   end
 
   it "should have a method for generating all necessary files" do
     Puppet::SSL::Host.new("me").should respond_to(:generate)
   end
 
   describe "when generating files" do
     before do
       @host = Puppet::SSL::Host.new("me")
       @host.stubs(:generate_key)
       @host.stubs(:generate_certificate_request)
     end
 
     it "should generate a key if one is not present" do
       @host.stubs(:key).returns nil
       @host.expects(:generate_key)
 
       @host.generate
     end
 
     it "should generate a certificate request if one is not present" do
       @host.expects(:certificate_request).returns nil
       @host.expects(:generate_certificate_request)
 
       @host.generate
     end
 
     describe "and it can create a certificate authority" do
       before do
         @ca = mock 'ca'
         Puppet::SSL::CertificateAuthority.stubs(:instance).returns @ca
       end
 
       it "should use the CA to sign its certificate request if it does not have a certificate" do
         @host.expects(:certificate).returns nil
 
         @ca.expects(:sign).with(@host.name, true)
 
         @host.generate
       end
     end
 
     describe "and it cannot create a certificate authority" do
       before do
         Puppet::SSL::CertificateAuthority.stubs(:instance).returns nil
       end
 
       it "should seek its certificate" do
         @host.expects(:certificate)
 
         @host.generate
       end
     end
   end
 
   it "should have a method for creating an SSL store" do
     Puppet::SSL::Host.new("me").should respond_to(:ssl_store)
   end
 
   it "should always return the same store" do
     host = Puppet::SSL::Host.new("foo")
     store = mock 'store'
     store.stub_everything
     OpenSSL::X509::Store.expects(:new).returns store
     host.ssl_store.should equal(host.ssl_store)
   end
 
   describe "when creating an SSL store" do
     before do
       @host = Puppet::SSL::Host.new("me")
       @store = mock 'store'
       @store.stub_everything
       OpenSSL::X509::Store.stubs(:new).returns @store
 
       Puppet[:localcacert] = "ssl_host_testing"
 
       Puppet::SSL::CertificateRevocationList.indirection.stubs(:find).returns(nil)
     end
 
     it "should accept a purpose" do
       @store.expects(:purpose=).with "my special purpose"
       @host.ssl_store("my special purpose")
     end
 
     it "should default to OpenSSL::X509::PURPOSE_ANY as the purpose" do
       @store.expects(:purpose=).with OpenSSL::X509::PURPOSE_ANY
       @host.ssl_store
     end
 
     it "should add the local CA cert file" do
       Puppet[:localcacert] = "/ca/cert/file"
       @store.expects(:add_file).with Puppet[:localcacert]
       @host.ssl_store
     end
 
     describe "and a CRL is available" do
       before do
         @crl = stub 'crl', :content => "real_crl"
         Puppet::SSL::CertificateRevocationList.indirection.stubs(:find).returns @crl
       end
 
       describe "and 'certificate_revocation' is true" do
         before do
           Puppet[:certificate_revocation] = true
         end
 
         it "should add the CRL" do
           @store.expects(:add_crl).with "real_crl"
           @host.ssl_store
         end
 
         it "should set the flags to OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK" do
           @store.expects(:flags=).with OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK
           @host.ssl_store
         end
       end
 
       describe "and 'certificate_revocation' is false" do
         before do
           Puppet[:certificate_revocation] = false
         end
 
         it "should not add the CRL" do
           @store.expects(:add_crl).never
           @host.ssl_store
         end
 
         it "should not set the flags" do
           @store.expects(:flags=).never
           @host.ssl_store
         end
       end
     end
   end
 
   describe "when waiting for a cert" do
     before do
       @host = Puppet::SSL::Host.new("me")
     end
 
     it "should generate its certificate request and attempt to read the certificate again if no certificate is found" do
       @host.expects(:certificate).times(2).returns(nil).then.returns "foo"
       @host.expects(:generate)
       @host.wait_for_cert(1)
     end
 
     it "should catch and log errors during CSR saving" do
       @host.expects(:certificate).times(2).returns(nil).then.returns "foo"
       @host.expects(:generate).raises(RuntimeError).then.returns nil
       @host.stubs(:sleep)
       @host.wait_for_cert(1)
     end
 
     it "should sleep and retry after failures saving the CSR if waitforcert is enabled" do
       @host.expects(:certificate).times(2).returns(nil).then.returns "foo"
       @host.expects(:generate).raises(RuntimeError).then.returns nil
       @host.expects(:sleep).with(1)
       @host.wait_for_cert(1)
     end
 
     it "should exit after failures saving the CSR of waitforcert is disabled" do
       @host.expects(:certificate).returns(nil)
       @host.expects(:generate).raises(RuntimeError)
       @host.expects(:puts)
       expect { @host.wait_for_cert(0) }.to exit_with 1
     end
 
     it "should exit if the wait time is 0 and it can neither find nor retrieve a certificate" do
       @host.stubs(:certificate).returns nil
       @host.expects(:generate)
       @host.expects(:puts)
       expect { @host.wait_for_cert(0) }.to exit_with 1
     end
 
     it "should sleep for the specified amount of time if no certificate is found after generating its certificate request" do
       @host.expects(:certificate).times(3).returns(nil).then.returns(nil).then.returns "foo"
       @host.expects(:generate)
 
       @host.expects(:sleep).with(1)
 
       @host.wait_for_cert(1)
     end
 
     it "should catch and log exceptions during certificate retrieval" do
       @host.expects(:certificate).times(3).returns(nil).then.raises(RuntimeError).then.returns("foo")
       @host.stubs(:generate)
       @host.stubs(:sleep)
 
       Puppet.expects(:err)
 
       @host.wait_for_cert(1)
     end
   end
 
   describe "when handling PSON", :unless => Puppet.features.microsoft_windows? do
     include PuppetSpec::Files
 
     before do
       Puppet[:vardir] = tmpdir("ssl_test_vardir")
       Puppet[:ssldir] = tmpdir("ssl_test_ssldir")
       # localcacert is where each client stores the CA certificate
       # cacert is where the master stores the CA certificate
       # Since we need to play the role of both for testing we need them to be the same and exist
       Puppet[:cacert] = Puppet[:localcacert]
 
       @ca=Puppet::SSL::CertificateAuthority.new
     end
 
     describe "when converting to PSON" do
       let(:host) do
         Puppet::SSL::Host.new("bazinga")
       end
 
       let(:pson_hash) do
         {
           "fingerprint"   => host.certificate_request.fingerprint,
           "desired_state" => 'requested',
           "name"          => host.name
         }
       end
 
       it "should be able to identify a host with an unsigned certificate request" do
         host.generate_certificate_request
 
         result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
 
         base_pson_comparison result, pson_hash
       end
 
       it "should validate against the schema" do
         host.generate_certificate_request
 
         expect(host.to_pson).to validate_against('api/schemas/host.json')
       end
 
       describe "explicit fingerprints" do
         [:SHA1, :SHA256, :SHA512].each do |md|
           it "should include #{md}" do
             mds = md.to_s
             host.generate_certificate_request
             pson_hash["fingerprints"] = {}
             pson_hash["fingerprints"][mds] = host.certificate_request.fingerprint(md)
 
             result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
             base_pson_comparison result, pson_hash
             result["fingerprints"][mds].should == pson_hash["fingerprints"][mds]
           end
         end
       end
 
       describe "dns_alt_names" do
         describe "when not specified" do
           it "should include the dns_alt_names associated with the certificate" do
             host.generate_certificate_request
             pson_hash["desired_alt_names"] = host.certificate_request.subject_alt_names
 
             result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
             base_pson_comparison result, pson_hash
             result["dns_alt_names"].should == pson_hash["desired_alt_names"]
           end
         end
 
         [ "",
           "test, alt, names"
         ].each do |alt_names|
           describe "when #{alt_names}" do
             before(:each) do
               host.generate_certificate_request :dns_alt_names => alt_names
             end
 
             it "should include the dns_alt_names associated with the certificate" do
               pson_hash["desired_alt_names"] = host.certificate_request.subject_alt_names
 
               result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
               base_pson_comparison result, pson_hash
               result["dns_alt_names"].should == pson_hash["desired_alt_names"]
             end
 
             it "should validate against the schema" do
               expect(host.to_pson).to validate_against('api/schemas/host.json')
             end
           end
         end
       end
 
       it "should be able to identify a host with a signed certificate" do
         host.generate_certificate_request
         @ca.sign(host.name)
         pson_hash = {
           "fingerprint"          => Puppet::SSL::Certificate.indirection.find(host.name).fingerprint,
           "desired_state"        => 'signed',
           "name"                 => host.name,
         }
 
         result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
         base_pson_comparison result, pson_hash
       end
 
       it "should be able to identify a host with a revoked certificate" do
         host.generate_certificate_request
         @ca.sign(host.name)
         @ca.revoke(host.name)
         pson_hash["fingerprint"] = Puppet::SSL::Certificate.indirection.find(host.name).fingerprint
         pson_hash["desired_state"] = 'revoked'
 
         result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
         base_pson_comparison result, pson_hash
       end
     end
 
     describe "when converting from PSON" do
       it "should return a Puppet::SSL::Host object with the specified desired state" do
         host = Puppet::SSL::Host.new("bazinga")
         host.desired_state="signed"
         pson_hash = {
           "name"  => host.name,
           "desired_state" => host.desired_state,
         }
         generated_host = Puppet::SSL::Host.from_data_hash(pson_hash)
         generated_host.desired_state.should == host.desired_state
         generated_host.name.should == host.name
       end
     end
   end
 end