diff --git a/lib/puppet/ssl/base.rb b/lib/puppet/ssl/base.rb
index f9bbcac64..668134f86 100644
--- a/lib/puppet/ssl/base.rb
+++ b/lib/puppet/ssl/base.rb
@@ -1,79 +1,79 @@
 require 'puppet/ssl'
 
 # The base class for wrapping SSL instances.
 class Puppet::SSL::Base
   # For now, use the YAML separator.
   SEPARATOR = "\n---\n"
 
   def self.from_multiple_s(text)
     text.split(SEPARATOR).collect { |inst| from_s(inst) }
   end
 
   def self.to_multiple_s(instances)
     instances.collect { |inst| inst.to_s }.join(SEPARATOR)
   end
 
   def self.wraps(klass)
     @wrapped_class = klass
   end
 
   def self.wrapped_class
     raise(Puppet::DevError, "#{self} has not declared what class it wraps") unless defined?(@wrapped_class)
     @wrapped_class
   end
 
   attr_accessor :name, :content
 
   # Is this file for the CA?
   def ca?
     name == Puppet::SSL::Host.ca_name
   end
 
   def generate
     raise Puppet::DevError, "#{self.class} did not override 'generate'"
   end
 
   def initialize(name)
     @name = name.to_s.downcase
   end
 
   # Read content from disk appropriately.
   def read(path)
     @content = wrapped_class.new(File.read(path))
   end
 
   # Convert our thing to pem.
   def to_s
     return "" unless content
     content.to_pem
   end
 
   # Provide the full text of the thing we're dealing with.
   def to_text
     return "" unless content
     content.to_text
   end
 
-  def fingerprint(md = :MD5)
-    require 'openssl/digest'
+  def fingerprint(md = :SHA256)
+    require 'openssl'
 
     # ruby 1.8.x openssl digest constants are string
     # but in 1.9.x they are symbols
     mds = md.to_s.upcase
     if OpenSSL::Digest.constants.include?(mds)
       md = mds
     elsif OpenSSL::Digest.constants.include?(mds.to_sym)
       md = mds.to_sym
     else
       raise ArgumentError, "#{md} is not a valid digest algorithm for fingerprinting certificate #{name}"
     end
 
     OpenSSL::Digest.const_get(md).hexdigest(content.to_der).scan(/../).join(':').upcase
   end
 
   private
 
   def wrapped_class
     self.class.wrapped_class
   end
 end
diff --git a/lib/puppet/ssl/certificate_authority.rb b/lib/puppet/ssl/certificate_authority.rb
index 179acd998..f7b8a9d7d 100644
--- a/lib/puppet/ssl/certificate_authority.rb
+++ b/lib/puppet/ssl/certificate_authority.rb
@@ -1,362 +1,362 @@
 require 'monitor'
 require 'puppet/ssl/host'
 require 'puppet/ssl/certificate_request'
 
 # The class that knows how to sign certificates.  It creates
 # a 'special' SSL::Host whose name is 'ca', thus indicating
 # that, well, it's the CA.  There's some magic in the
 # indirector/ssl_file terminus base class that does that
 # for us.
 #   This class mostly just signs certs for us, but
 # it can also be seen as a general interface into all of the
 # SSL stuff.
 class Puppet::SSL::CertificateAuthority
   # We will only sign extensions on this whitelist, ever.  Any CSR with a
   # requested extension that we don't recognize is rejected, against the risk
   # that it will introduce some security issue through our ignorance of it.
   #
   # Adding an extension to this whitelist simply means we will consider it
   # further, not that we will always accept a certificate with an extension
   # requested on this list.
   RequestExtensionWhitelist = %w{subjectAltName}
 
   require 'puppet/ssl/certificate_factory'
   require 'puppet/ssl/inventory'
   require 'puppet/ssl/certificate_revocation_list'
   require 'puppet/ssl/certificate_authority/interface'
   require 'puppet/network/authstore'
 
   extend MonitorMixin
 
   class CertificateVerificationError < RuntimeError
     attr_accessor :error_code
 
     def initialize(code)
       @error_code = code
     end
   end
 
   def self.singleton_instance
     synchronize do
       @singleton_instance ||= new
     end
   end
 
   class CertificateSigningError < RuntimeError
     attr_accessor :host
 
     def initialize(host)
       @host = host
     end
   end
 
   def self.ca?
     return false unless Puppet[:ca]
     return false unless Puppet.run_mode.master?
     true
   end
 
   # If this process can function as a CA, then return a singleton
   # instance.
   def self.instance
     return nil unless ca?
 
     singleton_instance
   end
 
   attr_reader :name, :host
 
   # Create and run an applicator.  I wanted to build an interface where you could do
   # something like 'ca.apply(:generate).to(:all) but I don't think it's really possible.
   def apply(method, options)
     raise ArgumentError, "You must specify the hosts to apply to; valid values are an array or the symbol :all" unless options[:to]
     applier = Interface.new(method, options)
     applier.apply(self)
   end
 
   # If autosign is configured, then autosign all CSRs that match our configuration.
   def autosign
     return unless auto = autosign?
 
     store = nil
     store = autosign_store(auto) if auto != true
 
     Puppet::SSL::CertificateRequest.indirection.search("*").each do |csr|
       sign(csr.name) if auto == true or store.allowed?(csr.name, "127.1.1.1")
     end
   end
 
   # Do we autosign?  This returns true, false, or a filename.
   def autosign?
     auto = Puppet[:autosign]
     return false if ['false', false].include?(auto)
     return true if ['true', true].include?(auto)
 
     raise ArgumentError, "The autosign configuration '#{auto}' must be a fully qualified file" unless auto =~ /^\//
     FileTest.exist?(auto) && auto
   end
 
   # Create an AuthStore for autosigning.
   def autosign_store(file)
     auth = Puppet::Network::AuthStore.new
     File.readlines(file).each do |line|
       next if line =~ /^\s*#/
       next if line =~ /^\s*$/
       auth.allow(line.chomp)
     end
 
     auth
   end
 
   # Retrieve (or create, if necessary) the certificate revocation list.
   def crl
     unless defined?(@crl)
       unless @crl = Puppet::SSL::CertificateRevocationList.indirection.find(Puppet::SSL::CA_NAME)
         @crl = Puppet::SSL::CertificateRevocationList.new(Puppet::SSL::CA_NAME)
         @crl.generate(host.certificate.content, host.key.content)
         Puppet::SSL::CertificateRevocationList.indirection.save(@crl)
       end
     end
     @crl
   end
 
   # Delegate this to our Host class.
   def destroy(name)
     Puppet::SSL::Host.destroy(name)
   end
 
   # Generate a new certificate.
   def generate(name, options = {})
     raise ArgumentError, "A Certificate already exists for #{name}" if Puppet::SSL::Certificate.indirection.find(name)
     host = Puppet::SSL::Host.new(name)
 
     # Pass on any requested subjectAltName field.
     san = options[:dns_alt_names]
 
     host = Puppet::SSL::Host.new(name)
     host.generate_certificate_request(:dns_alt_names => san)
     sign(name, !!san)
   end
 
   # Generate our CA certificate.
   def generate_ca_certificate
     generate_password unless password?
 
     host.generate_key unless host.key
 
     # Create a new cert request.  We do this specially, because we don't want
     # to actually save the request anywhere.
     request = Puppet::SSL::CertificateRequest.new(host.name)
 
     # We deliberately do not put any subjectAltName in here: the CA
     # certificate absolutely does not need them. --daniel 2011-10-13
     request.generate(host.key)
 
     # Create a self-signed certificate.
     @certificate = sign(host.name, false, request)
 
     # And make sure we initialize our CRL.
     crl
   end
 
   def initialize
     Puppet.settings.use :main, :ssl, :ca
 
     @name = Puppet[:certname]
 
     @host = Puppet::SSL::Host.new(Puppet::SSL::Host.ca_name)
 
     setup
   end
 
   # Retrieve (or create, if necessary) our inventory manager.
   def inventory
     @inventory ||= Puppet::SSL::Inventory.new
   end
 
   # Generate a new password for the CA.
   def generate_password
     pass = ""
     20.times { pass += (rand(74) + 48).chr }
 
     begin
       Puppet.settings.write(:capass) { |f| f.print pass }
     rescue Errno::EACCES => detail
       raise Puppet::Error, "Could not write CA password: #{detail}"
     end
 
     @password = pass
 
     pass
   end
 
   # List all signed certificates.
   def list
     Puppet::SSL::Certificate.indirection.search("*").collect { |c| c.name }
   end
 
   # Read the next serial from the serial file, and increment the
   # file so this one is considered used.
   def next_serial
     serial = nil
 
     # This is slightly odd.  If the file doesn't exist, our readwritelock creates
     # it, but with a mode we can't actually read in some cases.  So, use
     # a default before the lock.
     serial = 0x1 unless FileTest.exist?(Puppet[:serial])
 
     Puppet.settings.readwritelock(:serial) { |f|
       serial ||= File.read(Puppet.settings[:serial]).chomp.hex if FileTest.exist?(Puppet[:serial])
 
       # We store the next valid serial, not the one we just used.
       f << "%04X" % (serial + 1)
     }
 
     serial
   end
 
   # Does the password file exist?
   def password?
     FileTest.exist? Puppet[:capass]
   end
 
   # Print a given host's certificate as text.
   def print(name)
     (cert = Puppet::SSL::Certificate.indirection.find(name)) ? cert.to_text : nil
   end
 
   # Revoke a given certificate.
   def revoke(name)
     raise ArgumentError, "Cannot revoke certificates when the CRL is disabled" unless crl
 
     if cert = Puppet::SSL::Certificate.indirection.find(name)
       serial = cert.content.serial
     elsif ! serial = inventory.serial(name)
       raise ArgumentError, "Could not find a serial number for #{name}"
     end
     crl.revoke(serial, host.key.content)
   end
 
   # This initializes our CA so it actually works.  This should be a private
   # method, except that you can't any-instance stub private methods, which is
   # *awesome*.  This method only really exists to provide a stub-point during
   # testing.
   def setup
     generate_ca_certificate unless @host.certificate
   end
 
   # Sign a given certificate request.
   def sign(hostname, allow_dns_alt_names = false, self_signing_csr = nil)
     # This is a self-signed certificate
     if self_signing_csr
       # # This is a self-signed certificate, which is for the CA.  Since this
       # # forces the certificate to be self-signed, anyone who manages to trick
       # # the system into going through this path gets a certificate they could
       # # generate anyway.  There should be no security risk from that.
       csr = self_signing_csr
       cert_type = :ca
       issuer = csr.content
     else
       allow_dns_alt_names = true if hostname == Puppet[:certname].downcase
       unless csr = Puppet::SSL::CertificateRequest.indirection.find(hostname)
         raise ArgumentError, "Could not find certificate request for #{hostname}"
       end
 
       cert_type = :server
       issuer = host.certificate.content
 
       # Make sure that the CSR conforms to our internal signing policies.
       # This will raise if the CSR doesn't conform, but just in case...
       check_internal_signing_policies(hostname, csr, allow_dns_alt_names) or
         raise CertificateSigningError.new(hostname), "CSR had an unknown failure checking internal signing policies, will not sign!"
     end
 
     cert = Puppet::SSL::Certificate.new(hostname)
     cert.content = Puppet::SSL::CertificateFactory.
       build(cert_type, csr, issuer, next_serial)
-    cert.content.sign(host.key.content, OpenSSL::Digest::SHA1.new)
+    cert.content.sign(host.key.content, OpenSSL::Digest::SHA256.new)
 
     Puppet.notice "Signed certificate request for #{hostname}"
 
     # Add the cert to the inventory before we save it, since
     # otherwise we could end up with it being duplicated, if
     # this is the first time we build the inventory file.
     inventory.add(cert)
 
     # Save the now-signed cert.  This should get routed correctly depending
     # on the certificate type.
     Puppet::SSL::Certificate.indirection.save(cert)
 
     # And remove the CSR if this wasn't self signed.
     Puppet::SSL::CertificateRequest.indirection.destroy(csr.name) unless self_signing_csr
 
     cert
   end
 
   def check_internal_signing_policies(hostname, csr, allow_dns_alt_names)
     # Reject unknown request extensions.
     unknown_req = csr.request_extensions.
       reject {|x| RequestExtensionWhitelist.include? x["oid"] }
 
     if unknown_req and not unknown_req.empty?
       names = unknown_req.map {|x| x["oid"] }.sort.uniq.join(", ")
       raise CertificateSigningError.new(hostname), "CSR has request extensions that are not permitted: #{names}"
     end
 
     # Wildcards: we don't allow 'em at any point.
     #
     # The stringification here makes the content visible, and saves us having
     # to scrobble through the content of the CSR subject field to make sure it
     # is what we expect where we expect it.
     if csr.content.subject.to_s.include? '*'
       raise CertificateSigningError.new(hostname), "CSR subject contains a wildcard, which is not allowed: #{csr.content.subject.to_s}"
     end
 
     unless csr.subject_alt_names.empty?
       # If you alt names are allowed, they are required. Otherwise they are
       # disallowed. Self-signed certs are implicitly trusted, however.
       unless allow_dns_alt_names
         raise CertificateSigningError.new(hostname), "CSR '#{csr.name}' contains subject alternative names (#{csr.subject_alt_names.join(', ')}), which are disallowed. Use `puppet cert --allow-dns-alt-names sign #{csr.name}` to sign this request."
       end
 
       # If subjectAltNames are present, validate that they are only for DNS
       # labels, not any other kind.
       unless csr.subject_alt_names.all? {|x| x =~ /^DNS:/ }
         raise CertificateSigningError.new(hostname), "CSR '#{csr.name}' contains a subjectAltName outside the DNS label space: #{csr.subject_alt_names.join(', ')}.  To continue, this CSR needs to be cleaned."
       end
 
       # Check for wildcards in the subjectAltName fields too.
       if csr.subject_alt_names.any? {|x| x.include? '*' }
         raise CertificateSigningError.new(hostname), "CSR '#{csr.name}' subjectAltName contains a wildcard, which is not allowed: #{csr.subject_alt_names.join(', ')}  To continue, this CSR needs to be cleaned."
       end
     end
 
     return true                 # good enough for us!
   end
 
   # Verify a given host's certificate.
   def verify(name)
     unless cert = Puppet::SSL::Certificate.indirection.find(name)
       raise ArgumentError, "Could not find a certificate for #{name}"
     end
     store = OpenSSL::X509::Store.new
     store.add_file Puppet[:cacert]
     store.add_crl crl.content if self.crl
     store.purpose = OpenSSL::X509::PURPOSE_SSL_CLIENT
     store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK if Puppet.settings[:certificate_revocation]
 
     raise CertificateVerificationError.new(store.error), store.error_string unless store.verify(cert.content)
   end
 
-  def fingerprint(name, md = :MD5)
+  def fingerprint(name, md = :SHA256)
     unless cert = Puppet::SSL::Certificate.indirection.find(name) || Puppet::SSL::CertificateRequest.indirection.find(name)
       raise ArgumentError, "Could not find a certificate or csr for #{name}"
     end
     cert.fingerprint(md)
   end
 
   # List the waiting certificate requests.
   def waiting?
     Puppet::SSL::CertificateRequest.indirection.search("*").collect { |r| r.name }
   end
 end
diff --git a/lib/puppet/ssl/certificate_authority/interface.rb b/lib/puppet/ssl/certificate_authority/interface.rb
index 8a978b0b8..8f8371de2 100644
--- a/lib/puppet/ssl/certificate_authority/interface.rb
+++ b/lib/puppet/ssl/certificate_authority/interface.rb
@@ -1,178 +1,178 @@
 # This class is basically a hidden class that knows how to act
 # on the CA.  It's only used by the 'puppetca' executable, and its
 # job is to provide a CLI-like interface to the CA class.
 module Puppet
   module SSL
     class CertificateAuthority
       class Interface
         INTERFACE_METHODS = [:destroy, :list, :revoke, :generate, :sign, :print, :verify, :fingerprint]
 
         class InterfaceError < ArgumentError; end
 
         attr_reader :method, :subjects, :digest, :options
 
         # Actually perform the work.
         def apply(ca)
           unless subjects or method == :list
             raise ArgumentError, "You must provide hosts or --all when using #{method}"
           end
 
           begin
             return send(method, ca) if respond_to?(method)
 
             (subjects == :all ? ca.list : subjects).each do |host|
               ca.send(method, host)
             end
           rescue InterfaceError
             raise
           rescue => detail
             Puppet.log_exception(detail, "Could not call #{method}: #{detail}")
           end
         end
 
         def generate(ca)
           raise InterfaceError, "It makes no sense to generate all hosts; you must specify a list" if subjects == :all
 
           subjects.each do |host|
             ca.generate(host, options)
           end
         end
 
         def initialize(method, options)
           self.method = method
           self.subjects = options.delete(:to)
-          @digest = options.delete(:digest) || :MD5
+          @digest = options.delete(:digest) || :SHA256
           @options = options
         end
 
         # List the hosts.
         def list(ca)
           signed = ca.list
           requests = ca.waiting?
 
           case subjects
           when :all
             hosts = [signed, requests].flatten
           when :signed
             hosts = signed.flatten
           when nil
             hosts = requests
           else
             hosts = subjects
           end
 
           certs = {:signed => {}, :invalid => {}, :request => {}}
 
           return if hosts.empty?
 
           hosts.uniq.sort.each do |host|
             begin
               ca.verify(host) unless requests.include?(host)
             rescue Puppet::SSL::CertificateAuthority::CertificateVerificationError => details
               verify_error = details.to_s
             end
 
             if verify_error
               cert = Puppet::SSL::Certificate.indirection.find(host)
               certs[:invalid][host] = [cert, verify_error]
             elsif signed.include?(host)
               cert = Puppet::SSL::Certificate.indirection.find(host)
               certs[:signed][host] = cert
             else
               req = Puppet::SSL::CertificateRequest.indirection.find(host)
               certs[:request][host] = req
             end
           end
 
           names = certs.values.map(&:keys).flatten
 
           name_width = names.sort_by(&:length).last.length rescue 0
 
           output = [:request, :signed, :invalid].map do |type|
             next if certs[type].empty?
 
             certs[type].map do |host,info|
               format_host(ca, host, type, info, name_width)
             end
           end.flatten.compact.sort.join("\n")
 
           puts output
         end
 
         def format_host(ca, host, type, info, width)
           certish, verify_error = info
           alt_names = case type
                       when :signed
                         certish.subject_alt_names
                       when :request
                         certish.subject_alt_names
                       else
                         []
                       end
 
           alt_names.delete(host)
 
           alt_str = "(alt names: #{alt_names.join(', ')})" unless alt_names.empty?
 
           glyph = {:signed => '+', :request => ' ', :invalid => '-'}[type]
 
           name = host.ljust(width)
           fingerprint = "(#{ca.fingerprint(host, @digest)})"
 
           explanation = "(#{verify_error})" if verify_error
 
           [glyph, name, fingerprint, alt_str, explanation].compact.join(' ')
         end
 
         # Set the method to apply.
         def method=(method)
           raise ArgumentError, "Invalid method #{method} to apply" unless INTERFACE_METHODS.include?(method)
           @method = method
         end
 
         # Print certificate information.
         def print(ca)
           (subjects == :all ? ca.list  : subjects).each do |host|
             if value = ca.print(host)
               puts value
             else
               Puppet.err "Could not find certificate for #{host}"
             end
           end
         end
 
         # Print certificate information.
         def fingerprint(ca)
           (subjects == :all ? ca.list + ca.waiting?: subjects).each do |host|
             if value = ca.fingerprint(host, @digest)
               puts "#{host} #{value}"
             else
               Puppet.err "Could not find certificate for #{host}"
             end
           end
         end
 
         # Sign a given certificate.
         def sign(ca)
           list = subjects == :all ? ca.waiting? : subjects
           raise InterfaceError, "No waiting certificate requests to sign" if list.empty?
           list.each do |host|
             ca.sign(host, options[:allow_dns_alt_names])
           end
         end
 
         # Set the list of hosts we're operating on.  Also supports keywords.
         def subjects=(value)
           unless value == :all or value == :signed or value.is_a?(Array)
             raise ArgumentError, "Subjects must be an array or :all; not #{value}"
           end
 
           value = nil if value.is_a?(Array) and value.empty?
 
           @subjects = value
         end
       end
     end
   end
 end
 
diff --git a/lib/puppet/ssl/certificate_request.rb b/lib/puppet/ssl/certificate_request.rb
index 461dc5721..d028ec20f 100644
--- a/lib/puppet/ssl/certificate_request.rb
+++ b/lib/puppet/ssl/certificate_request.rb
@@ -1,149 +1,149 @@
 require 'puppet/ssl/base'
 
 # Manage certificate requests.
 class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
   wraps OpenSSL::X509::Request
 
   extend Puppet::Indirector
 
   # If auto-signing is on, sign any certificate requests as they are saved.
   module AutoSigner
     def save(instance, key = nil)
       super
 
       # Try to autosign the CSR.
       if ca = Puppet::SSL::CertificateAuthority.instance
         ca.autosign
       end
     end
   end
 
   indirects :certificate_request, :terminus_class => :file, :extend => AutoSigner
 
   # Convert a string into an instance.
   def self.from_s(string)
     instance = wrapped_class.new(string)
     name = instance.subject.to_s.sub(/\/CN=/i, '').downcase
     result = new(name)
     result.content = instance
     result
   end
 
   # Because of how the format handler class is included, this
   # can't be in the base class.
   def self.supported_formats
     [:s]
   end
 
   def extension_factory
     @ef ||= OpenSSL::X509::ExtensionFactory.new
   end
 
   # How to create a certificate request with our system defaults.
   def generate(key, options = {})
     Puppet.info "Creating a new SSL certificate request for #{name}"
 
     # Support either an actual SSL key, or a Puppet key.
     key = key.content if key.is_a?(Puppet::SSL::Key)
 
     # If we're a CSR for the CA, then use the real ca_name, rather than the
     # fake 'ca' name.  This is mostly for backward compatibility with 0.24.x,
     # but it's also just a good idea.
     common_name = name == Puppet::SSL::CA_NAME ? Puppet.settings[:ca_name] : name
 
     csr = OpenSSL::X509::Request.new
     csr.version = 0
     csr.subject = OpenSSL::X509::Name.new([["CN", common_name]])
     csr.public_key = key.public_key
 
     if options[:dns_alt_names] then
       names = options[:dns_alt_names].split(/\s*,\s*/).map(&:strip) + [name]
       names = names.sort.uniq.map {|name| "DNS:#{name}" }.join(", ")
       names = extension_factory.create_extension("subjectAltName", names, false)
 
       extReq = OpenSSL::ASN1::Set([OpenSSL::ASN1::Sequence([names])])
 
       # We only support the standard request extensions.  If you really need
       # msExtReq support, let us know and we can restore them. --daniel 2011-10-10
       csr.add_attribute(OpenSSL::X509::Attribute.new("extReq", extReq))
     end
 
-    csr.sign(key, OpenSSL::Digest::MD5.new)
+    csr.sign(key, OpenSSL::Digest::SHA256.new)
 
     raise Puppet::Error, "CSR sign verification failed; you need to clean the certificate request for #{name} on the server" unless csr.verify(key.public_key)
 
     @content = csr
-    Puppet.info "Certificate Request fingerprint (md5): #{fingerprint}"
+    Puppet.info "Certificate Request fingerprint (sha256): #{fingerprint}"
     @content
   end
 
   # Return the set of extensions requested on this CSR, in a form designed to
   # be useful to Ruby: a hash.  Which, not coincidentally, you can pass
   # successfully to the OpenSSL constructor later, if you want.
   def request_extensions
     raise Puppet::Error, "CSR needs content to extract fields" unless @content
 
     # Prefer the standard extReq, but accept the Microsoft specific version as
     # a fallback, if the standard version isn't found.
     ext = @content.attributes.find {|x| x.oid == "extReq" } or
       @content.attributes.find {|x| x.oid == "msExtReq" }
     return [] unless ext
 
     # Assert the structure and extract the names into an array of arrays.
     unless ext.value.is_a? OpenSSL::ASN1::Set
       raise Puppet::Error, "In #{ext.oid}, expected Set but found #{ext.value.class}"
     end
 
     unless ext.value.value.is_a? Array
       raise Puppet::Error, "In #{ext.oid}, expected Set[Array] but found #{ext.value.value.class}"
     end
 
     unless ext.value.value.length == 1
       raise Puppet::Error, "In #{ext.oid}, expected Set[Array[...]], but found #{ext.value.value.length} items in the array"
     end
 
     san = ext.value.value.first
     unless san.is_a? OpenSSL::ASN1::Sequence
       raise Puppet::Error, "In #{ext.oid}, expected Set[Array[Sequence[...]]], but found #{san.class}"
     end
     san = san.value
 
     # OK, now san should be the array of items, validate that...
     index = -1
     san.map do |name|
       index += 1
 
       unless name.is_a? OpenSSL::ASN1::Sequence
         raise Puppet::Error, "In #{ext.oid}, expected request extension record #{index} to be a Sequence, but found #{name.class}"
       end
       name = name.value
 
       # OK, turn that into an extension, to unpack the content.  Lovely that
       # we have to swap the order of arguments to the underlying method, or
       # perhaps that the ASN.1 representation chose to pack them in a
       # strange order where the optional component comes *earlier* than the
       # fixed component in the sequence.
       case name.length
       when 2
         ev = OpenSSL::X509::Extension.new(name[0].value, name[1].value)
         { "oid" => ev.oid, "value" => ev.value }
 
       when 3
         ev = OpenSSL::X509::Extension.new(name[0].value, name[2].value, name[1].value)
         { "oid" => ev.oid, "value" => ev.value, "critical" => ev.critical? }
 
       else
         raise Puppet::Error, "In #{ext.oid}, expected extension record #{index} to have two or three items, but found #{name.length}"
       end
     end.flatten
   end
 
   def subject_alt_names
     @subject_alt_names ||= request_extensions.
       select {|x| x["oid"] = "subjectAltName" }.
       map {|x| x["value"].split(/\s*,\s*/) }.
       flatten.
       sort.
       uniq
   end
 end
diff --git a/lib/puppet/ssl/certificate_revocation_list.rb b/lib/puppet/ssl/certificate_revocation_list.rb
index 293f4b8c0..a6820931a 100644
--- a/lib/puppet/ssl/certificate_revocation_list.rb
+++ b/lib/puppet/ssl/certificate_revocation_list.rb
@@ -1,84 +1,84 @@
 require 'puppet/ssl/base'
 require 'puppet/indirector'
 
 # Manage the CRL.
 class Puppet::SSL::CertificateRevocationList < Puppet::SSL::Base
   wraps OpenSSL::X509::CRL
 
   extend Puppet::Indirector
   indirects :certificate_revocation_list, :terminus_class => :file
 
   # Convert a string into an instance.
   def self.from_s(string)
     instance = wrapped_class.new(string)
     result = new('foo') # The name doesn't matter
     result.content = instance
     result
   end
 
   # Because of how the format handler class is included, this
   # can't be in the base class.
   def self.supported_formats
     [:s]
   end
 
   # Knows how to create a CRL with our system defaults.
   def generate(cert, cakey)
     Puppet.info "Creating a new certificate revocation list"
     @content = wrapped_class.new
     @content.issuer = cert.subject
     @content.version = 1
 
     # Init the CRL number.
     crlNum = OpenSSL::ASN1::Integer(0)
     @content.extensions = [OpenSSL::X509::Extension.new("crlNumber", crlNum)]
 
     # Set last/next update
     @content.last_update = Time.now
     # Keep CRL valid for 5 years
     @content.next_update = Time.now + 5 * 365*24*60*60
 
-    @content.sign(cakey, OpenSSL::Digest::SHA1.new)
+    @content.sign(cakey, OpenSSL::Digest::SHA256.new)
 
     @content
   end
 
   # The name doesn't actually matter; there's only one CRL.
   # We just need the name so our Indirector stuff all works more easily.
   def initialize(fakename)
     @name = "crl"
   end
 
   # Revoke the certificate with serial number SERIAL issued by this
   # CA, then write the CRL back to disk. The REASON must be one of the
   # OpenSSL::OCSP::REVOKED_* reasons
   def revoke(serial, cakey, reason = OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE)
     Puppet.notice "Revoked certificate with serial #{serial}"
     time = Time.now
 
     # Add our revocation to the CRL.
     revoked = OpenSSL::X509::Revoked.new
     revoked.serial = serial
     revoked.time = time
     enum = OpenSSL::ASN1::Enumerated(reason)
     ext = OpenSSL::X509::Extension.new("CRLReason", enum)
     revoked.add_extension(ext)
     @content.add_revoked(revoked)
 
     # Increment the crlNumber
     e = @content.extensions.find { |e| e.oid == 'crlNumber' }
     ext = @content.extensions.reject { |e| e.oid == 'crlNumber' }
     crlNum = OpenSSL::ASN1::Integer(e ? e.value.to_i + 1 : 0)
     ext << OpenSSL::X509::Extension.new("crlNumber", crlNum)
     @content.extensions = ext
 
     # Set last/next update
     @content.last_update = time
     # Keep CRL valid for 5 years
     @content.next_update = time + 5 * 365*24*60*60
 
     @content.sign(cakey, OpenSSL::Digest::SHA1.new)
 
     Puppet::SSL::CertificateRevocationList.indirection.save(self)
   end
 end
diff --git a/spec/unit/ssl/base_spec.rb b/spec/unit/ssl/base_spec.rb
index 125623b70..837fd61f8 100755
--- a/spec/unit/ssl/base_spec.rb
+++ b/spec/unit/ssl/base_spec.rb
@@ -1,42 +1,42 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'puppet/ssl/certificate'
 
 class TestCertificate < Puppet::SSL::Base; end
 
 describe Puppet::SSL::Certificate do
   before :each do
     @base = TestCertificate.new("name")
   end
 
   describe "when fingerprinting content" do
     before :each do
       @cert = stub 'cert', :to_der => "DER"
       @base.stubs(:content).returns(@cert)
-      OpenSSL::Digest.stubs(:constants).returns ["MD5", "DIGEST"]
+      OpenSSL::Digest.stubs(:constants).returns ["MD5", "SHA1", "SHA256", "SHA512", "DIGEST"]
       @digest = stub_everything
       OpenSSL::Digest.stubs(:const_get).returns @digest
     end
 
     it "should digest the certificate DER value and return a ':' seperated nibblet string" do
       @cert.expects(:to_der).returns("DER")
       @digest.expects(:hexdigest).with("DER").returns "digest"
 
       @base.fingerprint.should == "DI:GE:ST"
     end
 
     it "should raise an error if the digest algorithm is not defined" do
       OpenSSL::Digest.expects(:constants).returns []
 
       lambda { @base.fingerprint }.should raise_error
     end
 
     it "should use the given digest algorithm" do
       OpenSSL::Digest.stubs(:const_get).with("DIGEST").returns @digest
       @digest.expects(:hexdigest).with("DER").returns "digest"
 
       @base.fingerprint(:digest).should == "DI:GE:ST"
     end
   end
 end
diff --git a/spec/unit/ssl/certificate_authority/interface_spec.rb b/spec/unit/ssl/certificate_authority/interface_spec.rb
index 41a57b822..dbb872708 100755
--- a/spec/unit/ssl/certificate_authority/interface_spec.rb
+++ b/spec/unit/ssl/certificate_authority/interface_spec.rb
@@ -1,375 +1,375 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'puppet/ssl/certificate_authority'
 
 shared_examples_for "a normal interface method" do
   it "should call the method on the CA for each host specified if an array was provided" do
     @ca.expects(@method).with("host1")
     @ca.expects(@method).with("host2")
 
     @applier = Puppet::SSL::CertificateAuthority::Interface.new(@method, :to => %w{host1 host2})
 
     @applier.apply(@ca)
   end
 
   it "should call the method on the CA for all existing certificates if :all was provided" do
     @ca.expects(:list).returns %w{host1 host2}
 
     @ca.expects(@method).with("host1")
     @ca.expects(@method).with("host2")
 
     @applier = Puppet::SSL::CertificateAuthority::Interface.new(@method, :to => :all)
 
     @applier.apply(@ca)
   end
 end
 
 describe Puppet::SSL::CertificateAuthority::Interface do
   before do
     @class = Puppet::SSL::CertificateAuthority::Interface
   end
   describe "when initializing" do
     it "should set its method using its settor" do
       instance = @class.new(:generate, :to => :all)
       instance.method.should == :generate
     end
 
     it "should set its subjects using the settor" do
       instance = @class.new(:generate, :to => :all)
       instance.subjects.should == :all
     end
 
     it "should set the digest if given" do
       interface = @class.new(:generate, :to => :all, :digest => :digest)
       interface.digest.should == :digest
     end
 
-    it "should set the digest to md5 if none given" do
+    it "should set the digest to SHA256 if none given" do
       interface = @class.new(:generate, :to => :all)
-      interface.digest.should == :MD5
+      interface.digest.should == :SHA256
     end
   end
 
   describe "when setting the method" do
     it "should set the method" do
       instance = @class.new(:generate, :to => :all)
       instance.method = :list
 
       instance.method.should == :list
     end
 
     it "should fail if the method isn't a member of the INTERFACE_METHODS array" do
       lambda { @class.new(:thing, :to => :all) }.should raise_error(ArgumentError, /Invalid method thing to apply/)
     end
   end
 
   describe "when setting the subjects" do
     it "should set the subjects" do
       instance = @class.new(:generate, :to => :all)
       instance.subjects = :signed
 
       instance.subjects.should == :signed
     end
 
     it "should fail if the subjects setting isn't :all or an array" do
       lambda { @class.new(:generate, :to => "other") }.should raise_error(ArgumentError, /Subjects must be an array or :all; not other/)
     end
   end
 
   it "should have a method for triggering the application" do
     @class.new(:generate, :to => :all).should respond_to(:apply)
   end
 
   describe "when applying" do
     before do
       # We use a real object here, because :verify can't be stubbed, apparently.
       @ca = Object.new
     end
 
     it "should raise InterfaceErrors" do
       @applier = @class.new(:revoke, :to => :all)
 
       @ca.expects(:list).raises Puppet::SSL::CertificateAuthority::Interface::InterfaceError
 
       lambda { @applier.apply(@ca) }.should raise_error(Puppet::SSL::CertificateAuthority::Interface::InterfaceError)
     end
 
     it "should log non-Interface failures rather than failing" do
       @applier = @class.new(:revoke, :to => :all)
 
       @ca.expects(:list).raises ArgumentError
 
       Puppet.expects(:err)
 
       lambda { @applier.apply(@ca) }.should_not raise_error
     end
 
     describe "with an empty array specified and the method is not list" do
       it "should fail" do
         @applier = @class.new(:sign, :to => [])
         lambda { @applier.apply(@ca) }.should raise_error(ArgumentError)
       end
     end
 
     describe ":generate" do
       it "should fail if :all was specified" do
         @applier = @class.new(:generate, :to => :all)
         lambda { @applier.apply(@ca) }.should raise_error(ArgumentError)
       end
 
       it "should call :generate on the CA for each host specified" do
         @applier = @class.new(:generate, :to => %w{host1 host2})
 
         @ca.expects(:generate).with("host1", {})
         @ca.expects(:generate).with("host2", {})
 
         @applier.apply(@ca)
       end
     end
 
     describe ":verify" do
       before { @method = :verify }
       #it_should_behave_like "a normal interface method"
 
       it "should call the method on the CA for each host specified if an array was provided" do
         # LAK:NOTE Mocha apparently doesn't allow you to mock :verify, but I'm confident this works in real life.
       end
 
       it "should call the method on the CA for all existing certificates if :all was provided" do
         # LAK:NOTE Mocha apparently doesn't allow you to mock :verify, but I'm confident this works in real life.
       end
     end
 
     describe ":destroy" do
       before { @method = :destroy }
       it_should_behave_like "a normal interface method"
     end
 
     describe ":revoke" do
       before { @method = :revoke }
       it_should_behave_like "a normal interface method"
     end
 
     describe ":sign" do
       describe "and an array of names was provided" do
         let(:applier) { @class.new(:sign, @options.merge(:to => %w{host1 host2})) }
 
         it "should sign the specified waiting certificate requests" do
           @options = {:allow_dns_alt_names => false}
 
           @ca.expects(:sign).with("host1", false)
           @ca.expects(:sign).with("host2", false)
 
           applier.apply(@ca)
         end
 
         it "should sign the certificate requests with alt names if specified" do
           @options = {:allow_dns_alt_names => true}
 
           @ca.expects(:sign).with("host1", true)
           @ca.expects(:sign).with("host2", true)
 
           applier.apply(@ca)
         end
       end
 
       describe "and :all was provided" do
         it "should sign all waiting certificate requests" do
           @ca.stubs(:waiting?).returns(%w{cert1 cert2})
 
           @ca.expects(:sign).with("cert1", nil)
           @ca.expects(:sign).with("cert2", nil)
 
           @applier = @class.new(:sign, :to => :all)
           @applier.apply(@ca)
         end
 
         it "should fail if there are no waiting certificate requests" do
           @ca.stubs(:waiting?).returns([])
 
           @applier = @class.new(:sign, :to => :all)
           lambda { @applier.apply(@ca) }.should raise_error(Puppet::SSL::CertificateAuthority::Interface::InterfaceError)
         end
       end
     end
 
     describe ":list" do
       before :each do
         @cert = Puppet::SSL::Certificate.new 'foo'
         @csr = Puppet::SSL::CertificateRequest.new 'bar'
 
         @cert.stubs(:subject_alt_names).returns []
         @csr.stubs(:subject_alt_names).returns []
 
         Puppet::SSL::Certificate.indirection.stubs(:find).returns @cert
         Puppet::SSL::CertificateRequest.indirection.stubs(:find).returns @csr
 
         @ca.expects(:waiting?).returns %w{host1 host2 host3}
         @ca.expects(:list).returns %w{host4 host5 host6}
         @ca.stubs(:fingerprint).returns "fingerprint"
         @ca.stubs(:verify)
       end
 
       describe "and an empty array was provided" do
         it "should print all certificate requests" do
           applier = @class.new(:list, :to => [])
 
           applier.expects(:puts).with(<<-OUTPUT.chomp)
   host1 (fingerprint)
   host2 (fingerprint)
   host3 (fingerprint)
           OUTPUT
 
           applier.apply(@ca)
         end
       end
 
       describe "and :all was provided" do
         it "should print a string containing all certificate requests and certificates" do
           @ca.stubs(:verify).with("host4").raises(Puppet::SSL::CertificateAuthority::CertificateVerificationError.new(23), "certificate revoked")
 
           applier = @class.new(:list, :to => :all)
 
           applier.expects(:puts).with(<<-OUTPUT.chomp)
   host1 (fingerprint)
   host2 (fingerprint)
   host3 (fingerprint)
 + host5 (fingerprint)
 + host6 (fingerprint)
 - host4 (fingerprint) (certificate revoked)
           OUTPUT
 
           applier.apply(@ca)
         end
       end
 
       describe "and :signed was provided" do
         it "should print a string containing all signed certificate requests and certificates" do
           applier = @class.new(:list, :to => :signed)
 
           applier.expects(:puts).with(<<-OUTPUT.chomp)
 + host4 (fingerprint)
 + host5 (fingerprint)
 + host6 (fingerprint)
           OUTPUT
 
           applier.apply(@ca)
         end
 
         it "should include subject alt names if they are on the certificate request" do
           @csr.stubs(:subject_alt_names).returns ["DNS:foo", "DNS:bar"]
 
           applier = @class.new(:list, :to => ['host1'])
 
           applier.expects(:puts).with(<<-OUTPUT.chomp)
   host1 (fingerprint) (alt names: DNS:foo, DNS:bar)
           OUTPUT
 
           applier.apply(@ca)
         end
       end
 
       describe "and an array of names was provided" do
         it "should print all named hosts" do
           applier = @class.new(:list, :to => %w{host1 host2 host4 host5})
 
           applier.expects(:puts).with(<<-OUTPUT.chomp)
   host1 (fingerprint)
   host2 (fingerprint)
 + host4 (fingerprint)
 + host5 (fingerprint)
             OUTPUT
 
           applier.apply(@ca)
         end
       end
     end
 
     describe ":print" do
       describe "and :all was provided" do
         it "should print all certificates" do
           @ca.expects(:list).returns %w{host1 host2}
 
           @applier = @class.new(:print, :to => :all)
 
           @ca.expects(:print).with("host1").returns "h1"
           @applier.expects(:puts).with "h1"
 
           @ca.expects(:print).with("host2").returns "h2"
           @applier.expects(:puts).with "h2"
 
           @applier.apply(@ca)
         end
       end
 
       describe "and an array of names was provided" do
         it "should print each named certificate if found" do
           @applier = @class.new(:print, :to => %w{host1 host2})
 
           @ca.expects(:print).with("host1").returns "h1"
           @applier.expects(:puts).with "h1"
 
           @ca.expects(:print).with("host2").returns "h2"
           @applier.expects(:puts).with "h2"
 
           @applier.apply(@ca)
         end
 
         it "should log any named but not found certificates" do
           @applier = @class.new(:print, :to => %w{host1 host2})
 
           @ca.expects(:print).with("host1").returns "h1"
           @applier.expects(:puts).with "h1"
 
           @ca.expects(:print).with("host2").returns nil
           Puppet.expects(:err).with { |msg| msg.include?("host2") }
 
           @applier.apply(@ca)
         end
       end
     end
 
     describe ":fingerprint" do
       it "should fingerprint with the set digest algorithm" do
         @applier = @class.new(:fingerprint, :to => %w{host1}, :digest => :digest)
 
         @ca.expects(:fingerprint).with("host1", :digest).returns "fingerprint1"
         @applier.expects(:puts).with "host1 fingerprint1"
 
         @applier.apply(@ca)
       end
 
       describe "and :all was provided" do
         it "should fingerprint all certificates (including waiting ones)" do
           @ca.expects(:list).returns %w{host1}
           @ca.expects(:waiting?).returns %w{host2}
 
           @applier = @class.new(:fingerprint, :to => :all)
 
-          @ca.expects(:fingerprint).with("host1", :MD5).returns "fingerprint1"
+          @ca.expects(:fingerprint).with("host1", :SHA256).returns "fingerprint1"
           @applier.expects(:puts).with "host1 fingerprint1"
 
-          @ca.expects(:fingerprint).with("host2", :MD5).returns "fingerprint2"
+          @ca.expects(:fingerprint).with("host2", :SHA256).returns "fingerprint2"
           @applier.expects(:puts).with "host2 fingerprint2"
 
           @applier.apply(@ca)
         end
       end
 
       describe "and an array of names was provided" do
         it "should print each named certificate if found" do
           @applier = @class.new(:fingerprint, :to => %w{host1 host2})
 
-          @ca.expects(:fingerprint).with("host1", :MD5).returns "fingerprint1"
+          @ca.expects(:fingerprint).with("host1", :SHA256).returns "fingerprint1"
           @applier.expects(:puts).with "host1 fingerprint1"
 
-          @ca.expects(:fingerprint).with("host2", :MD5).returns "fingerprint2"
+          @ca.expects(:fingerprint).with("host2", :SHA256).returns "fingerprint2"
           @applier.expects(:puts).with "host2 fingerprint2"
 
           @applier.apply(@ca)
         end
       end
     end
   end
 end
diff --git a/spec/unit/ssl/certificate_authority_spec.rb b/spec/unit/ssl/certificate_authority_spec.rb
index 222b72e5f..33b692970 100755
--- a/spec/unit/ssl/certificate_authority_spec.rb
+++ b/spec/unit/ssl/certificate_authority_spec.rb
@@ -1,882 +1,882 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'puppet/ssl/certificate_authority'
 
 describe Puppet::SSL::CertificateAuthority do
   after do
     Puppet::SSL::CertificateAuthority.instance_variable_set(:@singleton_instance, nil)
     Puppet.settings.clearused
   end
 
   def stub_ca_host
     @key = mock 'key'
     @key.stubs(:content).returns "cakey"
     @cacert = mock 'certificate'
     @cacert.stubs(:content).returns "cacertificate"
 
     @host = stub 'ssl_host', :key => @key, :certificate => @cacert, :name => Puppet::SSL::Host.ca_name
   end
 
   it "should have a class method for returning a singleton instance" do
     Puppet::SSL::CertificateAuthority.should respond_to(:instance)
   end
 
   describe "when finding an existing instance" do
     describe "and the host is a CA host and the run_mode is master" do
       before do
         Puppet[:ca] = true
         Puppet.run_mode.stubs(:master?).returns true
 
         @ca = mock('ca')
         Puppet::SSL::CertificateAuthority.stubs(:new).returns @ca
       end
 
       it "should return an instance" do
         Puppet::SSL::CertificateAuthority.instance.should equal(@ca)
       end
 
       it "should always return the same instance" do
         Puppet::SSL::CertificateAuthority.instance.should equal(Puppet::SSL::CertificateAuthority.instance)
       end
     end
 
     describe "and the host is not a CA host" do
       it "should return nil" do
         Puppet.settings.stubs(:value).with(:ca).returns false
         Puppet.run_mode.stubs(:master?).returns true
 
         ca = mock('ca')
         Puppet::SSL::CertificateAuthority.expects(:new).never
         Puppet::SSL::CertificateAuthority.instance.should be_nil
       end
     end
 
     describe "and the run_mode is not master" do
       it "should return nil" do
         Puppet.settings.stubs(:value).with(:ca).returns true
         Puppet.run_mode.stubs(:master?).returns false
 
         ca = mock('ca')
         Puppet::SSL::CertificateAuthority.expects(:new).never
         Puppet::SSL::CertificateAuthority.instance.should be_nil
       end
     end
   end
 
   describe "when initializing" do
     before do
       Puppet.settings.stubs(:use)
       Puppet.settings.stubs(:value).returns "ca_testing"
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:setup)
     end
 
     it "should always set its name to the value of :certname" do
       Puppet.settings.expects(:value).with(:certname).returns "ca_testing"
 
       Puppet::SSL::CertificateAuthority.new.name.should == "ca_testing"
     end
 
     it "should create an SSL::Host instance whose name is the 'ca_name'" do
       Puppet::SSL::Host.expects(:ca_name).returns "caname"
 
       host = stub 'host'
       Puppet::SSL::Host.expects(:new).with("caname").returns host
 
       Puppet::SSL::CertificateAuthority.new
     end
 
     it "should use the :main, :ca, and :ssl settings sections" do
       Puppet.settings.expects(:use).with(:main, :ssl, :ca)
       Puppet::SSL::CertificateAuthority.new
     end
 
     it "should create an inventory instance" do
       Puppet::SSL::Inventory.expects(:new).returns "inventory"
 
       Puppet::SSL::CertificateAuthority.new.inventory.should == "inventory"
     end
 
     it "should make sure the CA is set up" do
       Puppet::SSL::CertificateAuthority.any_instance.expects(:setup)
 
       Puppet::SSL::CertificateAuthority.new
     end
   end
 
   describe "when setting itself up" do
     it "should generate the CA certificate if it does not have one" do
       Puppet.settings.stubs :use
 
       host = stub 'host'
       Puppet::SSL::Host.stubs(:new).returns host
 
       host.expects(:certificate).returns nil
 
       Puppet::SSL::CertificateAuthority.any_instance.expects(:generate_ca_certificate)
       Puppet::SSL::CertificateAuthority.new
     end
   end
 
   describe "when retrieving the certificate revocation list" do
     before do
       Puppet.settings.stubs(:use)
       Puppet.settings.stubs(:value).returns "ca_testing"
       Puppet.settings.stubs(:value).with(:cacrl).returns "/my/crl"
 
       cert = stub("certificate", :content => "real_cert")
       key = stub("key", :content => "real_key")
       @host = stub 'host', :certificate => cert, :name => "hostname", :key => key
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:setup)
       @ca = Puppet::SSL::CertificateAuthority.new
 
       @ca.stubs(:host).returns @host
     end
 
     it "should return any found CRL instance" do
       crl = mock 'crl'
       Puppet::SSL::CertificateRevocationList.indirection.expects(:find).returns crl
       @ca.crl.should equal(crl)
     end
 
     it "should create, generate, and save a new CRL instance of no CRL can be found" do
       crl = Puppet::SSL::CertificateRevocationList.new("fakename")
       Puppet::SSL::CertificateRevocationList.indirection.expects(:find).returns nil
 
       Puppet::SSL::CertificateRevocationList.expects(:new).returns crl
 
       crl.expects(:generate).with(@ca.host.certificate.content, @ca.host.key.content)
       Puppet::SSL::CertificateRevocationList.indirection.expects(:save).with(crl)
 
       @ca.crl.should equal(crl)
     end
   end
 
   describe "when generating a self-signed CA certificate" do
     before do
       Puppet.settings.stubs(:use)
       Puppet.settings.stubs(:value).returns "ca_testing"
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:setup)
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:crl)
       @ca = Puppet::SSL::CertificateAuthority.new
 
       @host = stub 'host', :key => mock("key"), :name => "hostname", :certificate => mock('certificate')
 
       Puppet::SSL::CertificateRequest.any_instance.stubs(:generate)
 
       @ca.stubs(:host).returns @host
     end
 
     it "should create and store a password at :capass" do
       Puppet.settings.expects(:value).with(:capass).returns "/path/to/pass"
 
       FileTest.expects(:exist?).with("/path/to/pass").returns false
 
       fh = mock 'filehandle'
       Puppet.settings.expects(:write).with(:capass).yields fh
 
       fh.expects(:print).with { |s| s.length > 18 }
 
       @ca.stubs(:sign)
 
       @ca.generate_ca_certificate
     end
 
     it "should generate a key if one does not exist" do
       @ca.stubs :generate_password
       @ca.stubs :sign
 
       @ca.host.expects(:key).returns nil
       @ca.host.expects(:generate_key)
 
       @ca.generate_ca_certificate
     end
 
     it "should create and sign a self-signed cert using the CA name" do
       request = mock 'request'
       Puppet::SSL::CertificateRequest.expects(:new).with(@ca.host.name).returns request
       request.expects(:generate).with(@ca.host.key)
       request.stubs(:request_extensions => [])
 
       @ca.expects(:sign).with(@host.name, false, request)
 
       @ca.stubs :generate_password
 
       @ca.generate_ca_certificate
     end
 
     it "should generate its CRL" do
       @ca.stubs :generate_password
       @ca.stubs :sign
 
       @ca.host.expects(:key).returns nil
       @ca.host.expects(:generate_key)
 
       @ca.expects(:crl)
 
       @ca.generate_ca_certificate
     end
   end
 
   describe "when signing" do
     before do
       Puppet.settings.stubs(:use)
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:password?).returns true
 
       stub_ca_host
 
       Puppet::SSL::Host.expects(:new).with(Puppet::SSL::Host.ca_name).returns @host
 
       @ca = Puppet::SSL::CertificateAuthority.new
 
       @name = "myhost"
       @real_cert = stub 'realcert', :sign => nil
       @cert = Puppet::SSL::Certificate.new(@name)
       @cert.content = @real_cert
 
       Puppet::SSL::Certificate.stubs(:new).returns @cert
 
       @cert.stubs(:content=)
       Puppet::SSL::Certificate.indirection.stubs(:save)
 
       # Stub out the factory
       Puppet::SSL::CertificateFactory.stubs(:build).returns "my real cert"
 
       @request_content = stub "request content stub", :subject => @name
       @request = stub 'request', :name => @name, :request_extensions => [], :subject_alt_names => [], :content => @request_content
 
       # And the inventory
       @inventory = stub 'inventory', :add => nil
       @ca.stubs(:inventory).returns @inventory
 
       Puppet::SSL::CertificateRequest.indirection.stubs(:destroy)
     end
 
     describe "and calculating the next certificate serial number" do
       before do
         @path = "/path/to/serial"
         Puppet.settings.stubs(:value).with(:serial).returns @path
 
         @filehandle = stub 'filehandle', :<< => @filehandle
         Puppet.settings.stubs(:readwritelock).with(:serial).yields @filehandle
       end
 
       it "should default to 0x1 for the first serial number" do
         @ca.next_serial.should == 0x1
       end
 
       it "should return the current content of the serial file" do
         FileTest.stubs(:exist?).with(@path).returns true
         File.expects(:read).with(@path).returns "0002"
 
         @ca.next_serial.should == 2
       end
 
       it "should write the next serial number to the serial file as hex" do
         @filehandle.expects(:<<).with("0002")
 
         @ca.next_serial
       end
 
       it "should lock the serial file while writing" do
         Puppet.settings.expects(:readwritelock).with(:serial)
 
         @ca.next_serial
       end
     end
 
     describe "its own certificate" do
       before do
         @serial = 10
         @ca.stubs(:next_serial).returns @serial
       end
 
       it "should not look up a certificate request for the host" do
         Puppet::SSL::CertificateRequest.indirection.expects(:find).never
 
         @ca.sign(@name, true, @request)
       end
 
       it "should use a certificate type of :ca" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[0] == :ca
         end.returns "my real cert"
         @ca.sign(@name, :ca, @request)
       end
 
       it "should pass the provided CSR as the CSR" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[1] == @request
         end.returns "my real cert"
         @ca.sign(@name, :ca, @request)
       end
 
       it "should use the provided CSR's content as the issuer" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[2].subject == "myhost"
         end.returns "my real cert"
         @ca.sign(@name, :ca, @request)
       end
 
       it "should pass the next serial as the serial number" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[3] == @serial
         end.returns "my real cert"
         @ca.sign(@name, :ca, @request)
       end
 
       it "should sign the certificate request even if it contains alt names" do
         @request.stubs(:subject_alt_names).returns %w[DNS:foo DNS:bar DNS:baz]
 
         expect do
           @ca.sign(@name, false, @request)
         end.should_not raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError)
       end
 
       it "should save the resulting certificate" do
         Puppet::SSL::Certificate.indirection.expects(:save).with(@cert)
 
         @ca.sign(@name, :ca, @request)
       end
     end
 
     describe "another host's certificate" do
       before do
         @serial = 10
         @ca.stubs(:next_serial).returns @serial
 
         Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
         Puppet::SSL::CertificateRequest.indirection.stubs :save
       end
 
       it "should use a certificate type of :server" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[0] == :server
         end.returns "my real cert"
 
         @ca.sign(@name)
       end
 
       it "should use look up a CSR for the host in the :ca_file terminus" do
         Puppet::SSL::CertificateRequest.indirection.expects(:find).with(@name).returns @request
 
         @ca.sign(@name)
       end
 
       it "should fail if no CSR can be found for the host" do
         Puppet::SSL::CertificateRequest.indirection.expects(:find).with(@name).returns nil
 
         lambda { @ca.sign(@name) }.should raise_error(ArgumentError)
       end
 
       it "should fail if an unknown request extension is present" do
         @request.stubs :request_extensions => [{ "oid"   => "bananas",
                                                  "value" => "delicious" }]
         expect { @ca.sign(@name) }.
           should raise_error(/CSR has request extensions that are not permitted/)
       end
 
       it "should fail if the CSR contains alt names and they are not expected" do
         @request.stubs(:subject_alt_names).returns %w[DNS:foo DNS:bar DNS:baz]
 
         expect do
           @ca.sign(@name, false)
         end.to raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError, /CSR '#{@name}' contains subject alternative names \(.*?\), which are disallowed. Use `puppet cert --allow-dns-alt-names sign #{@name}` to sign this request./)
       end
 
       it "should not fail if the CSR does not contain alt names and they are expected" do
         @request.stubs(:subject_alt_names).returns []
         expect { @ca.sign(@name, true) }.should_not raise_error
       end
 
       it "should reject alt names by default" do
         @request.stubs(:subject_alt_names).returns %w[DNS:foo DNS:bar DNS:baz]
 
         expect do
           @ca.sign(@name)
         end.to raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError, /CSR '#{@name}' contains subject alternative names \(.*?\), which are disallowed. Use `puppet cert --allow-dns-alt-names sign #{@name}` to sign this request./)
       end
 
       it "should use the CA certificate as the issuer" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[2] == @cacert.content
         end.returns "my real cert"
         @ca.sign(@name)
       end
 
       it "should pass the next serial as the serial number" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[3] == @serial
         end.returns "my real cert"
         @ca.sign(@name)
       end
 
       it "should sign the resulting certificate using its real key and a digest" do
         digest = mock 'digest'
-        OpenSSL::Digest::SHA1.expects(:new).returns digest
+        OpenSSL::Digest::SHA256.expects(:new).returns digest
 
         key = stub 'key', :content => "real_key"
         @ca.host.stubs(:key).returns key
 
         @cert.content.expects(:sign).with("real_key", digest)
         @ca.sign(@name)
       end
 
       it "should save the resulting certificate" do
         Puppet::SSL::Certificate.indirection.stubs(:save).with(@cert)
         @ca.sign(@name)
       end
 
       it "should remove the host's certificate request" do
         Puppet::SSL::CertificateRequest.indirection.expects(:destroy).with(@name)
 
         @ca.sign(@name)
       end
 
       it "should check the internal signing policies" do
         @ca.expects(:check_internal_signing_policies).returns true
         @ca.sign(@name)
       end
     end
 
     context "#check_internal_signing_policies" do
       before do
         @serial = 10
         @ca.stubs(:next_serial).returns @serial
 
         Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
         @cert.stubs :save
       end
 
       it "should reject a critical extension that isn't on the whitelist" do
         @request.stubs(:request_extensions).returns [{ "oid" => "banana",
                                                        "value" => "yumm",
                                                        "critical" => true }]
         expect { @ca.sign(@name) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /request extensions that are not permitted/
         )
       end
 
       it "should reject a non-critical extension that isn't on the whitelist" do
         @request.stubs(:request_extensions).returns [{ "oid" => "peach",
                                                        "value" => "meh",
                                                        "critical" => false }]
         expect { @ca.sign(@name) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /request extensions that are not permitted/
         )
       end
 
       it "should reject non-whitelist extensions even if a valid extension is present" do
         @request.stubs(:request_extensions).returns [{ "oid" => "peach",
                                                        "value" => "meh",
                                                        "critical" => false },
                                                      { "oid" => "subjectAltName",
                                                        "value" => "DNS:foo",
                                                        "critical" => true }]
         expect { @ca.sign(@name) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /request extensions that are not permitted/
         )
       end
 
       it "should reject a subjectAltName for a non-DNS value" do
         @request.stubs(:subject_alt_names).returns ['DNS:foo', 'email:bar@example.com']
         expect { @ca.sign(@name, true) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /subjectAltName outside the DNS label space/
         )
       end
 
       it "should reject a wildcard subject" do
         @request.content.stubs(:subject).
           returns(OpenSSL::X509::Name.new([["CN", "*.local"]]))
 
         expect { @ca.sign(@name) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /subject contains a wildcard/
         )
       end
 
       it "should reject a wildcard subjectAltName" do
         @request.stubs(:subject_alt_names).returns ['DNS:foo', 'DNS:*.bar']
         expect { @ca.sign(@name, true) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /subjectAltName contains a wildcard/
         )
       end
     end
 
     it "should create a certificate instance with the content set to the newly signed x509 certificate" do
       @serial = 10
       @ca.stubs(:next_serial).returns @serial
 
       Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
       Puppet::SSL::Certificate.indirection.stubs :save
       Puppet::SSL::Certificate.expects(:new).with(@name).returns @cert
 
       @ca.sign(@name)
     end
 
     it "should return the certificate instance" do
       @ca.stubs(:next_serial).returns @serial
       Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
       Puppet::SSL::Certificate.indirection.stubs :save
       @ca.sign(@name).should equal(@cert)
     end
 
     it "should add the certificate to its inventory" do
       @ca.stubs(:next_serial).returns @serial
       @inventory.expects(:add).with(@cert)
 
       Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
       Puppet::SSL::Certificate.indirection.stubs :save
       @ca.sign(@name)
     end
 
     it "should have a method for triggering autosigning of available CSRs" do
       @ca.should respond_to(:autosign)
     end
 
     describe "when autosigning certificates" do
       it "should do nothing if autosign is disabled" do
         Puppet.settings.expects(:value).with(:autosign).returns 'false'
 
         Puppet::SSL::CertificateRequest.indirection.expects(:search).never
         @ca.autosign
       end
 
       it "should do nothing if no autosign.conf exists" do
         Puppet.settings.expects(:value).with(:autosign).returns '/auto/sign'
         FileTest.expects(:exist?).with("/auto/sign").returns false
 
         Puppet::SSL::CertificateRequest.indirection.expects(:search).never
         @ca.autosign
       end
 
       describe "and autosign is enabled and the autosign.conf file exists" do
         before do
           Puppet.settings.stubs(:value).with(:autosign).returns '/auto/sign'
           FileTest.stubs(:exist?).with("/auto/sign").returns true
           File.stubs(:readlines).with("/auto/sign").returns ["one\n", "two\n"]
 
           Puppet::SSL::CertificateRequest.indirection.stubs(:search).returns []
 
           @store = stub 'store', :allow => nil
           Puppet::Network::AuthStore.stubs(:new).returns @store
         end
 
         describe "when creating the AuthStore instance to verify autosigning" do
           it "should create an AuthStore with each line in the configuration file allowed to be autosigned" do
             Puppet::Network::AuthStore.expects(:new).returns @store
 
             @store.expects(:allow).with("one")
             @store.expects(:allow).with("two")
 
             @ca.autosign
           end
 
           it "should reparse the autosign configuration on each call" do
             Puppet::Network::AuthStore.expects(:new).times(2).returns @store
 
             @ca.autosign
             @ca.autosign
           end
 
           it "should ignore comments" do
             File.stubs(:readlines).with("/auto/sign").returns ["one\n", "#two\n"]
 
             @store.expects(:allow).with("one")
             @ca.autosign
           end
 
           it "should ignore blank lines" do
             File.stubs(:readlines).with("/auto/sign").returns ["one\n", "\n"]
 
             @store.expects(:allow).with("one")
             @ca.autosign
           end
         end
 
         it "should sign all CSRs whose hostname matches the autosign configuration" do
           csr1 = mock 'csr1'
           csr2 = mock 'csr2'
           Puppet::SSL::CertificateRequest.indirection.stubs(:search).returns [csr1, csr2]
         end
 
         it "should not sign CSRs whose hostname does not match the autosign configuration" do
           csr1 = mock 'csr1'
           csr2 = mock 'csr2'
           Puppet::SSL::CertificateRequest.indirection.stubs(:search).returns [csr1, csr2]
         end
       end
     end
   end
 
   describe "when managing certificate clients" do
     before do
       Puppet.settings.stubs(:use)
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:password?).returns true
 
       stub_ca_host
 
       Puppet::SSL::Host.expects(:new).returns @host
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:host).returns @host
 
       @cacert = mock 'certificate'
       @cacert.stubs(:content).returns "cacertificate"
       @ca = Puppet::SSL::CertificateAuthority.new
     end
 
     it "should have a method for acting on the SSL files" do
       @ca.should respond_to(:apply)
     end
 
     describe "when applying a method to a set of hosts" do
       it "should fail if no subjects have been specified" do
         lambda { @ca.apply(:generate) }.should raise_error(ArgumentError)
       end
 
       it "should create an Interface instance with the specified method and the options" do
         Puppet::SSL::CertificateAuthority::Interface.expects(:new).with(:generate, :to => :host).returns(stub('applier', :apply => nil))
         @ca.apply(:generate, :to => :host)
       end
 
       it "should apply the Interface with itself as the argument" do
         applier = stub('applier')
         applier.expects(:apply).with(@ca)
         Puppet::SSL::CertificateAuthority::Interface.expects(:new).returns applier
         @ca.apply(:generate, :to => :ca_testing)
       end
     end
 
     it "should be able to list waiting certificate requests" do
       req1 = stub 'req1', :name => "one"
       req2 = stub 'req2', :name => "two"
       Puppet::SSL::CertificateRequest.indirection.expects(:search).with("*").returns [req1, req2]
 
       @ca.waiting?.should == %w{one two}
     end
 
     it "should delegate removing hosts to the Host class" do
       Puppet::SSL::Host.expects(:destroy).with("myhost")
 
       @ca.destroy("myhost")
     end
 
     it "should be able to verify certificates" do
       @ca.should respond_to(:verify)
     end
 
     it "should list certificates as the sorted list of all existing signed certificates" do
       cert1 = stub 'cert1', :name => "cert1"
       cert2 = stub 'cert2', :name => "cert2"
       Puppet::SSL::Certificate.indirection.expects(:search).with("*").returns [cert1, cert2]
       @ca.list.should == %w{cert1 cert2}
     end
 
     describe "and printing certificates" do
       it "should return nil if the certificate cannot be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns nil
         @ca.print("myhost").should be_nil
       end
 
       it "should print certificates by calling :to_text on the host's certificate" do
         cert1 = stub 'cert1', :name => "cert1", :to_text => "mytext"
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns cert1
         @ca.print("myhost").should == "mytext"
       end
     end
 
     describe "and fingerprinting certificates" do
       before :each do
         @cert = stub 'cert', :name => "cert", :fingerprint => "DIGEST"
         Puppet::SSL::Certificate.indirection.stubs(:find).with("myhost").returns @cert
         Puppet::SSL::CertificateRequest.indirection.stubs(:find).with("myhost")
       end
 
       it "should raise an error if the certificate or CSR cannot be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns nil
         Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myhost").returns nil
         lambda { @ca.fingerprint("myhost") }.should raise_error
       end
 
       it "should try to find a CSR if no certificate can be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns nil
         Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myhost").returns @cert
         @cert.expects(:fingerprint)
         @ca.fingerprint("myhost")
       end
 
       it "should delegate to the certificate fingerprinting" do
         @cert.expects(:fingerprint)
         @ca.fingerprint("myhost")
       end
 
       it "should propagate the digest algorithm to the certificate fingerprinting system" do
         @cert.expects(:fingerprint).with(:digest)
         @ca.fingerprint("myhost", :digest)
       end
     end
 
     describe "and verifying certificates" do
       before do
         @store = stub 'store', :verify => true, :add_file => nil, :purpose= => nil, :add_crl => true, :flags= => nil
 
         OpenSSL::X509::Store.stubs(:new).returns @store
 
         Puppet.settings.stubs(:value).returns "crtstuff"
 
         @cert = stub 'cert', :content => "mycert"
         Puppet::SSL::Certificate.indirection.stubs(:find).returns @cert
 
         @crl = stub('crl', :content => "mycrl")
 
         @ca.stubs(:crl).returns @crl
       end
 
       it "should fail if the host's certificate cannot be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("me").returns(nil)
 
         lambda { @ca.verify("me") }.should raise_error(ArgumentError)
       end
 
       it "should create an SSL Store to verify" do
         OpenSSL::X509::Store.expects(:new).returns @store
 
         @ca.verify("me")
       end
 
       it "should add the CA Certificate to the store" do
         Puppet.settings.stubs(:value).with(:cacert).returns "/ca/cert"
         @store.expects(:add_file).with "/ca/cert"
 
         @ca.verify("me")
       end
 
       it "should add the CRL to the store if the crl is enabled" do
         @store.expects(:add_crl).with "mycrl"
 
         @ca.verify("me")
       end
 
       it "should set the store purpose to OpenSSL::X509::PURPOSE_SSL_CLIENT" do
         Puppet.settings.stubs(:value).with(:cacert).returns "/ca/cert"
         @store.expects(:add_file).with "/ca/cert"
 
         @ca.verify("me")
       end
 
       it "should set the store flags to check the crl" do
         @store.expects(:flags=).with OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK
 
         @ca.verify("me")
       end
 
       it "should use the store to verify the certificate" do
         @cert.expects(:content).returns "mycert"
 
         @store.expects(:verify).with("mycert").returns true
 
         @ca.verify("me")
       end
 
       it "should fail if the verification returns false" do
         @cert.expects(:content).returns "mycert"
 
         @store.expects(:verify).with("mycert").returns false
 
         lambda { @ca.verify("me") }.should raise_error
       end
     end
 
     describe "and revoking certificates" do
       before do
         @crl = mock 'crl'
         @ca.stubs(:crl).returns @crl
 
         @ca.stubs(:next_serial).returns 10
 
         @real_cert = stub 'real_cert', :serial => 15
         @cert = stub 'cert', :content => @real_cert
         Puppet::SSL::Certificate.indirection.stubs(:find).returns @cert
 
       end
 
       it "should fail if the certificate revocation list is disabled" do
         @ca.stubs(:crl).returns false
 
         lambda { @ca.revoke('ca_testing') }.should raise_error(ArgumentError)
 
       end
 
       it "should delegate the revocation to its CRL" do
         @ca.crl.expects(:revoke)
 
         @ca.revoke('host')
       end
 
       it "should get the serial number from the local certificate if it exists" do
         @ca.crl.expects(:revoke).with { |serial, key| serial == 15 }
 
         Puppet::SSL::Certificate.indirection.expects(:find).with("host").returns @cert
 
         @ca.revoke('host')
       end
 
       it "should get the serial number from inventory if no local certificate exists" do
         real_cert = stub 'real_cert', :serial => 15
         cert = stub 'cert', :content => real_cert
         Puppet::SSL::Certificate.indirection.expects(:find).with("host").returns nil
 
         @ca.inventory.expects(:serial).with("host").returns 16
 
         @ca.crl.expects(:revoke).with { |serial, key| serial == 16 }
         @ca.revoke('host')
       end
     end
 
     it "should be able to generate a complete new SSL host" do
       @ca.should respond_to(:generate)
     end
 
     describe "and generating certificates" do
       before do
         @host = stub 'host', :generate_certificate_request => nil
         Puppet::SSL::Host.stubs(:new).returns @host
         Puppet::SSL::Certificate.indirection.stubs(:find).returns nil
 
         @ca.stubs(:sign)
       end
 
       it "should fail if a certificate already exists for the host" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("him").returns "something"
 
         lambda { @ca.generate("him") }.should raise_error(ArgumentError)
       end
 
       it "should create a new Host instance with the correct name" do
         Puppet::SSL::Host.expects(:new).with("him").returns @host
 
         @ca.generate("him")
       end
 
       it "should use the Host to generate the certificate request" do
         @host.expects :generate_certificate_request
 
         @ca.generate("him")
       end
 
       it "should sign the generated request" do
         @ca.expects(:sign).with("him", false)
         @ca.generate("him")
       end
     end
   end
 end
diff --git a/spec/unit/ssl/certificate_request_spec.rb b/spec/unit/ssl/certificate_request_spec.rb
index 9a27397d4..9731ed309 100755
--- a/spec/unit/ssl/certificate_request_spec.rb
+++ b/spec/unit/ssl/certificate_request_spec.rb
@@ -1,277 +1,277 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'puppet/ssl/certificate_request'
 require 'puppet/ssl/key'
 
 describe Puppet::SSL::CertificateRequest do
   before do
     @class = Puppet::SSL::CertificateRequest
   end
 
   it "should be extended with the Indirector module" do
     @class.singleton_class.should be_include(Puppet::Indirector)
   end
 
   it "should indirect certificate_request" do
     @class.indirection.name.should == :certificate_request
   end
 
   it "should use any provided name as its name" do
     @class.new("myname").name.should == "myname"
   end
 
   it "should only support the text format" do
     @class.supported_formats.should == [:s]
   end
 
   describe "when converting from a string" do
     it "should create a CSR instance with its name set to the CSR subject and its content set to the extracted CSR" do
       csr = stub 'csr', :subject => "/CN=Foo.madstop.com"
       OpenSSL::X509::Request.expects(:new).with("my csr").returns(csr)
 
       mycsr = stub 'sslcsr'
       mycsr.expects(:content=).with(csr)
 
       @class.expects(:new).with("foo.madstop.com").returns mycsr
 
       @class.from_s("my csr")
     end
   end
 
   describe "when managing instances" do
     before do
       @request = @class.new("myname")
     end
 
     it "should have a name attribute" do
       @request.name.should == "myname"
     end
 
     it "should downcase its name" do
       @class.new("MyName").name.should == "myname"
     end
 
     it "should have a content attribute" do
       @request.should respond_to(:content)
     end
 
     it "should be able to read requests from disk" do
       path = "/my/path"
       File.expects(:read).with(path).returns("my request")
       request = mock 'request'
       OpenSSL::X509::Request.expects(:new).with("my request").returns(request)
       @request.read(path).should equal(request)
       @request.content.should equal(request)
     end
 
     it "should return an empty string when converted to a string with no request" do
       @request.to_s.should == ""
     end
 
     it "should convert the request to pem format when converted to a string" do
       request = mock 'request', :to_pem => "pem"
       @request.content = request
       @request.to_s.should == "pem"
     end
 
     it "should have a :to_text method that it delegates to the actual key" do
       real_request = mock 'request'
       real_request.expects(:to_text).returns "requesttext"
       @request.content = real_request
       @request.to_text.should == "requesttext"
     end
   end
 
   describe "when generating" do
     before do
       @instance = @class.new("myname")
 
       key = Puppet::SSL::Key.new("myname")
       @key = key.generate
 
       @request = OpenSSL::X509::Request.new
       OpenSSL::X509::Request.expects(:new).returns(@request)
 
       @request.stubs(:verify).returns(true)
     end
 
     it "should use the content of the provided key if the key is a Puppet::SSL::Key instance" do
       key = Puppet::SSL::Key.new("test")
       key.expects(:content).returns @key
 
       @request.expects(:sign).with{ |key, digest| key == @key }
       @instance.generate(key)
     end
 
     it "should log that it is creating a new certificate request" do
       Puppet.expects(:info).twice
       @instance.generate(@key)
     end
 
     it "should set the subject to [CN, name]" do
       subject = mock 'subject'
       OpenSSL::X509::Name.expects(:new).with([["CN", @instance.name]]).returns(subject)
       @request.expects(:subject=).with(subject)
       @instance.generate(@key)
     end
 
     it "should set the CN to the CSR name when the CSR is not for a CA" do
       subject = mock 'subject'
       OpenSSL::X509::Name.expects(:new).with { |subject| subject[0][1] == @instance.name }.returns(subject)
       @request.expects(:subject=).with(subject)
       @instance.generate(@key)
     end
 
     it "should set the CN to the :ca_name setting when the CSR is for a CA" do
       subject = mock 'subject'
       Puppet[:ca_name] = "mycertname"
       OpenSSL::X509::Name.expects(:new).with { |subject| subject[0][1] == "mycertname" }.returns(subject)
       @request.expects(:subject=).with(subject)
       Puppet::SSL::CertificateRequest.new(Puppet::SSL::CA_NAME).generate(@key)
     end
 
     it "should set the version to 0" do
       @request.expects(:version=).with(0)
       @instance.generate(@key)
     end
 
     it "should set the public key to the provided key's public key" do
       # Yay, the private key extracts a new key each time.
       pubkey = @key.public_key
       @key.stubs(:public_key).returns pubkey
       @request.expects(:public_key=).with(@key.public_key)
       @instance.generate(@key)
     end
 
     context "without subjectAltName / dns_alt_names" do
       before :each do
         Puppet[:dns_alt_names] = ""
       end
 
       ["extreq", "msExtReq"].each do |name|
         it "should not add any #{name} attribute" do
           @request.expects(:add_attribute).never
           @request.expects(:attributes=).never
           @instance.generate(@key)
         end
 
         it "should return no subjectAltNames" do
           @instance.generate(@key)
           @instance.subject_alt_names.should be_empty
         end
       end
     end
 
     context "with dns_alt_names" do
       before :each do
         Puppet[:dns_alt_names] = "one, two, three"
       end
 
       ["extreq", "msExtReq"].each do |name|
         it "should not add any #{name} attribute" do
           @request.expects(:add_attribute).never
           @request.expects(:attributes=).never
           @instance.generate(@key)
         end
 
         it "should return no subjectAltNames" do
           @instance.generate(@key)
           @instance.subject_alt_names.should be_empty
         end
       end
     end
 
     context "with subjectAltName to generate request" do
       before :each do
         Puppet[:dns_alt_names] = ""
       end
 
       it "should add an extreq attribute" do
         @request.expects(:add_attribute).with do |arg|
           arg.value.value.all? do |x|
             x.value.all? do |y|
               y.value[0].value == "subjectAltName"
             end
           end
         end
 
         @instance.generate(@key, :dns_alt_names => 'one, two')
       end
 
       it "should return the subjectAltName values" do
         @instance.generate(@key, :dns_alt_names => 'one,two')
         @instance.subject_alt_names.should =~ ["DNS:myname", "DNS:one", "DNS:two"]
       end
     end
 
     it "should sign the csr with the provided key and a digest" do
       digest = mock 'digest'
-      OpenSSL::Digest::MD5.expects(:new).returns(digest)
+      OpenSSL::Digest::SHA256.expects(:new).returns(digest)
       @request.expects(:sign).with(@key, digest)
       @instance.generate(@key)
     end
 
     it "should verify the generated request using the public key" do
       # Stupid keys don't have a competent == method.
       @request.expects(:verify).with { |public_key| public_key.to_s == @key.public_key.to_s }.returns true
       @instance.generate(@key)
     end
 
     it "should fail if verification fails" do
       @request.expects(:verify).returns false
 
       lambda { @instance.generate(@key) }.should raise_error(Puppet::Error)
     end
 
     it "should fingerprint the request" do
       @instance.expects(:fingerprint)
       @instance.generate(@key)
     end
 
     it "should display the fingerprint" do
       Puppet.stubs(:info)
       @instance.stubs(:fingerprint).returns("FINGERPRINT")
       Puppet.expects(:info).with { |s| s =~ /FINGERPRINT/ }
       @instance.generate(@key)
     end
 
     it "should return the generated request" do
       @instance.generate(@key).should equal(@request)
     end
 
     it "should set its content to the generated request" do
       @instance.generate(@key)
       @instance.content.should equal(@request)
     end
   end
 
   describe "when a CSR is saved" do
     describe "and a CA is available" do
       it "should save the CSR and trigger autosigning" do
         ca = mock 'ca', :autosign
         Puppet::SSL::CertificateAuthority.expects(:instance).returns ca
 
         csr = Puppet::SSL::CertificateRequest.new("me")
         terminus = mock 'terminus'
         Puppet::SSL::CertificateRequest.indirection.expects(:prepare).returns(terminus)
         terminus.expects(:save).with { |request| request.instance == csr && request.key == "me" }
 
         Puppet::SSL::CertificateRequest.indirection.save(csr)
       end
     end
 
     describe "and a CA is not available" do
       it "should save the CSR" do
         Puppet::SSL::CertificateAuthority.expects(:instance).returns nil
 
         csr = Puppet::SSL::CertificateRequest.new("me")
         terminus = mock 'terminus'
         Puppet::SSL::CertificateRequest.indirection.expects(:prepare).returns(terminus)
         terminus.expects(:save).with { |request| request.instance == csr && request.key == "me" }
 
         Puppet::SSL::CertificateRequest.indirection.save(csr)
       end
     end
   end
 end