diff --git a/spec/integration/ssl/certificate_authority_spec.rb b/spec/integration/ssl/certificate_authority_spec.rb
index 68b2401fb..dc8af6a7b 100755
--- a/spec/integration/ssl/certificate_authority_spec.rb
+++ b/spec/integration/ssl/certificate_authority_spec.rb
@@ -1,132 +1,130 @@
 #!/usr/bin/env rspec
 #
 #  Created by Luke Kanies on 2008-4-17.
 #  Copyright (c) 2008. All rights reserved.
 
 require 'spec_helper'
 
 require 'puppet/ssl/certificate_authority'
-require 'tempfile'
 
-describe Puppet::SSL::CertificateAuthority, :fails_on_windows => true do
+describe Puppet::SSL::CertificateAuthority, :unless => Puppet.features.microsoft_windows? do
+  include PuppetSpec::Files
+
   before do
     # Get a safe temporary file
-    file = Tempfile.new("ca_integration_testing")
-    @dir = file.path
-    file.delete
+    dir = tmpdir("ca_integration_testing")
 
-    Puppet.settings[:confdir] = @dir
-    Puppet.settings[:vardir] = @dir
+    Puppet.settings[:confdir] = dir
+    Puppet.settings[:vardir] = dir
     Puppet.settings[:group] = Process.gid
 
     Puppet::SSL::Host.ca_location = :local
     @ca = Puppet::SSL::CertificateAuthority.new
   end
 
   after {
     Puppet::SSL::Host.ca_location = :none
 
-    system("rm -rf #{@dir}")
     Puppet.settings.clear
 
     Puppet::SSL::CertificateAuthority.instance_variable_set("@instance", nil)
   }
 
   it "should create a CA host" do
     @ca.host.should be_ca
   end
 
   it "should be able to generate a certificate" do
     @ca.generate_ca_certificate
 
     @ca.host.certificate.should be_instance_of(Puppet::SSL::Certificate)
   end
 
   it "should be able to generate a new host certificate" do
     @ca.generate("newhost")
 
     Puppet::SSL::Certificate.indirection.find("newhost").should be_instance_of(Puppet::SSL::Certificate)
   end
 
   it "should be able to revoke a host certificate" do
     @ca.generate("newhost")
 
     @ca.revoke("newhost")
 
     lambda { @ca.verify("newhost") }.should raise_error
   end
 
   it "should have a CRL" do
     @ca.generate_ca_certificate
     @ca.crl.should_not be_nil
   end
 
   it "should be able to read in a previously created CRL" do
     @ca.generate_ca_certificate
 
     # Create it to start with.
     @ca.crl
 
     Puppet::SSL::CertificateAuthority.new.crl.should_not be_nil
   end
 
   describe "when signing certificates" do
     before do
       @host = Puppet::SSL::Host.new("luke.madstop.com")
 
       # We have to provide the key, since when we're in :ca_only mode, we can only interact
       # with the CA key.
       key = Puppet::SSL::Key.new(@host.name)
       key.generate
 
       @host.key = key
       @host.generate_certificate_request
 
       path = File.join(Puppet[:requestdir], "luke.madstop.com.pem")
     end
 
     it "should be able to sign certificates" do
       @ca.sign("luke.madstop.com")
     end
 
     it "should save the signed certificate" do
       @ca.sign("luke.madstop.com")
 
       Puppet::SSL::Certificate.indirection.find("luke.madstop.com").should be_instance_of(Puppet::SSL::Certificate)
     end
 
     it "should be able to sign multiple certificates" do
       @other = Puppet::SSL::Host.new("other.madstop.com")
       okey = Puppet::SSL::Key.new(@other.name)
       okey.generate
       @other.key = okey
       @other.generate_certificate_request
 
       @ca.sign("luke.madstop.com")
       @ca.sign("other.madstop.com")
 
       Puppet::SSL::Certificate.indirection.find("other.madstop.com").should be_instance_of(Puppet::SSL::Certificate)
       Puppet::SSL::Certificate.indirection.find("luke.madstop.com").should be_instance_of(Puppet::SSL::Certificate)
     end
 
     it "should save the signed certificate to the :signeddir" do
       @ca.sign("luke.madstop.com")
 
       client_cert = File.join(Puppet[:signeddir], "luke.madstop.com.pem")
       File.read(client_cert).should == Puppet::SSL::Certificate.indirection.find("luke.madstop.com").content.to_s
     end
 
     it "should save valid certificates" do
       @ca.sign("luke.madstop.com")
 
       unless ssl = Puppet::Util::which('openssl')
         pending "No ssl available"
       else
         ca_cert = Puppet[:cacert]
         client_cert = File.join(Puppet[:signeddir], "luke.madstop.com.pem")
         output = %x{openssl verify -CAfile #{ca_cert} #{client_cert}}
         $CHILD_STATUS.should == 0
       end
     end
   end
 end
diff --git a/spec/integration/ssl/certificate_request_spec.rb b/spec/integration/ssl/certificate_request_spec.rb
index 07a4d9269..6c1c8b964 100755
--- a/spec/integration/ssl/certificate_request_spec.rb
+++ b/spec/integration/ssl/certificate_request_spec.rb
@@ -1,62 +1,59 @@
 #!/usr/bin/env rspec
 #
 #  Created by Luke Kanies on 2008-4-17.
 #  Copyright (c) 2008. All rights reserved.
 
 require 'spec_helper'
 
 require 'puppet/ssl/certificate_request'
-require 'tempfile'
 
+# REMIND: Fails on windows because there is no user provider yet
 describe Puppet::SSL::CertificateRequest, :fails_on_windows => true do
+  include PuppetSpec::Files
+
   before do
     # Get a safe temporary file
-    file = Tempfile.new("csr_integration_testing")
-    @dir = file.path
-    file.delete
-
-    Dir.mkdir(@dir)
+    dir = tmpdir("csr_integration_testing")
 
     Puppet.settings.clear
 
-    Puppet.settings[:confdir] = @dir
-    Puppet.settings[:vardir] = @dir
+    Puppet.settings[:confdir] = dir
+    Puppet.settings[:vardir] = dir
     Puppet.settings[:group] = Process.gid
 
     Puppet::SSL::Host.ca_location = :none
 
     @csr = Puppet::SSL::CertificateRequest.new("luke.madstop.com")
 
     @key = OpenSSL::PKey::RSA.new(512)
 
     # This is necessary so the terminus instances don't lie around.
     Puppet::SSL::CertificateRequest.indirection.termini.clear
   end
 
   after do
-    system("rm -rf #{@dir}")
     Puppet.settings.clear
   end
 
   it "should be able to generate CSRs" do
     @csr.generate(@key)
   end
 
   it "should be able to save CSRs" do
     Puppet::SSL::CertificateRequest.indirection.save(@csr)
   end
 
   it "should be able to find saved certificate requests via the Indirector" do
     @csr.generate(@key)
     Puppet::SSL::CertificateRequest.indirection.save(@csr)
 
     Puppet::SSL::CertificateRequest.indirection.find("luke.madstop.com").should be_instance_of(Puppet::SSL::CertificateRequest)
   end
 
   it "should save the completely CSR when saving" do
     @csr.generate(@key)
     Puppet::SSL::CertificateRequest.indirection.save(@csr)
 
     Puppet::SSL::CertificateRequest.indirection.find("luke.madstop.com").content.to_s.should == @csr.content.to_s
   end
 end
diff --git a/spec/integration/ssl/certificate_revocation_list_spec.rb b/spec/integration/ssl/certificate_revocation_list_spec.rb
index 5d2b102f5..d140fd950 100755
--- a/spec/integration/ssl/certificate_revocation_list_spec.rb
+++ b/spec/integration/ssl/certificate_revocation_list_spec.rb
@@ -1,43 +1,42 @@
 #!/usr/bin/env rspec
 #
 #  Created by Luke Kanies on 2008-5-5.
 #  Copyright (c) 2008. All rights reserved.
 
 require 'spec_helper'
 
 require 'puppet/ssl/certificate_revocation_list'
-require 'tempfile'
 
+# REMIND: Fails on windows because there is no user provider yet
 describe Puppet::SSL::CertificateRevocationList, :fails_on_windows => true do
+  include PuppetSpec::Files
+
   before do
     # Get a safe temporary file
-    file = Tempfile.new("ca_integration_testing")
-    @dir = file.path
-    file.delete
+    dir = tmpdir("ca_integration_testing")
 
-    Puppet.settings[:confdir] = @dir
-    Puppet.settings[:vardir] = @dir
+    Puppet.settings[:confdir] = dir
+    Puppet.settings[:vardir] = dir
     Puppet.settings[:group] = Process.gid
 
     Puppet::SSL::Host.ca_location = :local
   end
 
   after {
     Puppet::SSL::Host.ca_location = :none
 
-    system("rm -rf #{@dir}")
     Puppet.settings.clear
 
     # This is necessary so the terminus instances don't lie around.
     Puppet::SSL::Host.indirection.termini.clear
   }
 
   it "should be able to read in written out CRLs with no revoked certificates" do
     ca = Puppet::SSL::CertificateAuthority.new
 
     raise "CRL not created" unless FileTest.exist?(Puppet[:hostcrl])
 
     crl = Puppet::SSL::CertificateRevocationList.new("crl_int_testing")
     crl.read(Puppet[:hostcrl])
   end
 end
diff --git a/spec/integration/ssl/host_spec.rb b/spec/integration/ssl/host_spec.rb
index 53ff88ea4..94e245554 100755
--- a/spec/integration/ssl/host_spec.rb
+++ b/spec/integration/ssl/host_spec.rb
@@ -1,90 +1,89 @@
 #!/usr/bin/env rspec
 #
 #  Created by Luke Kanies on 2008-4-17.
 #  Copyright (c) 2008. All rights reserved.
 
 require 'spec_helper'
 
 require 'puppet/ssl/host'
-require 'tempfile'
 
+# REMIND: Fails on windows because there is no user provider yet
 describe Puppet::SSL::Host, :fails_on_windows => true do
+  include PuppetSpec::Files
+
   before do
     # Get a safe temporary file
-    file = Tempfile.new("host_integration_testing")
-    @dir = file.path
-    file.delete
+    dir = tmpdir("host_integration_testing")
 
-    Puppet.settings[:confdir] = @dir
-    Puppet.settings[:vardir] = @dir
+    Puppet.settings[:confdir] = dir
+    Puppet.settings[:vardir] = dir
     Puppet.settings[:group] = Process.gid
 
     Puppet::SSL::Host.ca_location = :local
 
     @host = Puppet::SSL::Host.new("luke.madstop.com")
     @ca = Puppet::SSL::CertificateAuthority.new
   end
 
   after {
     Puppet::SSL::Host.ca_location = :none
 
-    system("rm -rf #{@dir}")
     Puppet.settings.clear
   }
 
   it "should be considered a CA host if its name is equal to 'ca'" do
     Puppet::SSL::Host.new(Puppet::SSL::CA_NAME).should be_ca
   end
 
   describe "when managing its key" do
     it "should be able to generate and save a key" do
       @host.generate_key
     end
 
     it "should save the key such that the Indirector can find it" do
       @host.generate_key
 
       Puppet::SSL::Key.indirection.find(@host.name).content.to_s.should == @host.key.to_s
     end
 
     it "should save the private key into the :privatekeydir" do
       @host.generate_key
       File.read(File.join(Puppet.settings[:privatekeydir], "luke.madstop.com.pem")).should == @host.key.to_s
     end
   end
 
   describe "when managing its certificate request" do
     it "should be able to generate and save a certificate request" do
       @host.generate_certificate_request
     end
 
     it "should save the certificate request such that the Indirector can find it" do
       @host.generate_certificate_request
 
       Puppet::SSL::CertificateRequest.indirection.find(@host.name).content.to_s.should == @host.certificate_request.to_s
     end
 
     it "should save the private certificate request into the :privatekeydir" do
       @host.generate_certificate_request
       File.read(File.join(Puppet.settings[:requestdir], "luke.madstop.com.pem")).should == @host.certificate_request.to_s
     end
   end
 
   describe "when the CA host" do
     it "should never store its key in the :privatekeydir" do
       Puppet.settings.use(:main, :ssl, :ca)
       @ca = Puppet::SSL::Host.new(Puppet::SSL::Host.ca_name)
       @ca.generate_key
 
       FileTest.should_not be_exist(File.join(Puppet[:privatekeydir], "ca.pem"))
     end
   end
 
-  it "should pass the verification of its own SSL store" do
+  it "should pass the verification of its own SSL store", :unless => Puppet.features.microsoft_windows? do
     @host.generate
     @ca = Puppet::SSL::CertificateAuthority.new
     @ca.sign(@host.name)
 
     @host.ssl_store.verify(@host.certificate.content).should be_true
   end
 end
diff --git a/spec/unit/indirector/certificate_request/ca_spec.rb b/spec/unit/indirector/certificate_request/ca_spec.rb
index fb758b59e..36628df9d 100755
--- a/spec/unit/indirector/certificate_request/ca_spec.rb
+++ b/spec/unit/indirector/certificate_request/ca_spec.rb
@@ -1,64 +1,64 @@
 #!/usr/bin/env rspec
 #
 #  Created by Luke Kanies on 2008-3-7.
 #  Copyright (c) 2007. All rights reserved.
 
 require 'spec_helper'
 
 require 'puppet/ssl/host'
 require 'puppet/sslcertificates'
 require 'puppet/sslcertificates/ca'
 require 'puppet/indirector/certificate_request/ca'
 
-describe Puppet::SSL::CertificateRequest::Ca, :fails_on_windows => true do
+describe Puppet::SSL::CertificateRequest::Ca, :unless => Puppet.features.microsoft_windows? do
   include PuppetSpec::Files
 
   before :each do
     Puppet[:ssldir] = tmpdir('ssl')
 
     Puppet::SSL::Host.ca_location = :local
     Puppet[:localcacert] = Puppet[:cacert]
     Puppet::SSLCertificates::CA.new.mkrootcert
 
     @ca = Puppet::SSL::CertificateAuthority.new
   end
 
   after :all do
     Puppet::SSL::Host.ca_location = :none
   end
 
   it "should have documentation" do
     Puppet::SSL::CertificateRequest::Ca.doc.should be_instance_of(String)
   end
 
   it "should use the :csrdir as the collection directory" do
     Puppet.settings.expects(:value).with(:csrdir).returns "/request/dir"
     Puppet::SSL::CertificateRequest::Ca.collection_directory.should == "/request/dir"
   end
 
   it "should overwrite the previous certificate request if allow_duplicate_certs is true" do
     Puppet[:allow_duplicate_certs] = true
     host = Puppet::SSL::Host.new("foo")
     host.generate_certificate_request
     @ca.sign(host.name)
 
     Puppet::SSL::Host.indirection.find("foo").generate_certificate_request
 
     Puppet::SSL::Certificate.indirection.find("foo").name.should == "foo"
     Puppet::SSL::CertificateRequest.indirection.find("foo").name.should == "foo"
     Puppet::SSL::Host.indirection.find("foo").state.should == "requested"
   end
 
   it "should reject a new certificate request if allow_duplicate_certs is false" do
     Puppet[:allow_duplicate_certs] = false
     host = Puppet::SSL::Host.new("bar")
     host.generate_certificate_request
     @ca.sign(host.name)
 
     expect { Puppet::SSL::Host.indirection.find("bar").generate_certificate_request }.should raise_error(/ignoring certificate request/)
 
     Puppet::SSL::Certificate.indirection.find("bar").name.should == "bar"
     Puppet::SSL::CertificateRequest.indirection.find("bar").should be_nil
     Puppet::SSL::Host.indirection.find("bar").state.should == "signed"
   end
 end
diff --git a/spec/unit/ssl/host_spec.rb b/spec/unit/ssl/host_spec.rb
index f00451619..226acdecd 100755
--- a/spec/unit/ssl/host_spec.rb
+++ b/spec/unit/ssl/host_spec.rb
@@ -1,783 +1,792 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'puppet/ssl/host'
 require 'puppet/sslcertificates'
 require 'puppet/sslcertificates/ca'
 
+# REMIND: Fails on windows because there is no user provider yet
 describe Puppet::SSL::Host, :fails_on_windows => true do
+  include PuppetSpec::Files
+
   before do
     Puppet::SSL::Host.indirection.terminus_class = :file
+
+    # Get a safe temporary file
+    dir = tmpdir("ssl_host_testing")
+    Puppet.settings[:confdir] = dir
+    Puppet.settings[:vardir] = dir
+
     @host = Puppet::SSL::Host.new("myname")
   end
 
   after do
     # Cleaned out any cached localhost instance.
     Puppet::SSL::Host.instance_variable_set(:@localhost, nil)
     Puppet::SSL::Host.ca_location = :none
   end
 
   it "should use any provided name as its name" do
     @host.name.should == "myname"
   end
 
   it "should retrieve its public key from its private key" do
     realkey = mock 'realkey'
     key = stub 'key', :content => realkey
     Puppet::SSL::Key.indirection.stubs(:find).returns(key)
     pubkey = mock 'public_key'
     realkey.expects(:public_key).returns pubkey
 
     @host.public_key.should equal(pubkey)
   end
 
   it "should default to being a non-ca host" do
     @host.ca?.should be_false
   end
 
   it "should be a ca host if its name matches the CA_NAME" do
     Puppet::SSL::Host.stubs(:ca_name).returns "yayca"
     Puppet::SSL::Host.new("yayca").should be_ca
   end
 
   it "should have a method for determining the CA location" do
     Puppet::SSL::Host.should respond_to(:ca_location)
   end
 
   it "should have a method for specifying the CA location" do
     Puppet::SSL::Host.should respond_to(:ca_location=)
   end
 
   it "should have a method for retrieving the default ssl host" do
     Puppet::SSL::Host.should respond_to(:ca_location=)
   end
 
   it "should have a method for producing an instance to manage the local host's keys" do
     Puppet::SSL::Host.should respond_to(:localhost)
   end
 
   it "should generate the certificate for the localhost instance if no certificate is available" do
     host = stub 'host', :key => nil
     Puppet::SSL::Host.expects(:new).returns host
 
     host.expects(:certificate).returns nil
     host.expects(:generate)
 
     Puppet::SSL::Host.localhost.should equal(host)
   end
 
   it "should always read the key for the localhost instance in from disk" do
     host = stub 'host', :certificate => "eh"
     Puppet::SSL::Host.expects(:new).returns host
 
     host.expects(:key)
 
     Puppet::SSL::Host.localhost
   end
 
   it "should cache the localhost instance" do
     host = stub 'host', :certificate => "eh", :key => 'foo'
     Puppet::SSL::Host.expects(:new).once.returns host
 
     Puppet::SSL::Host.localhost.should == Puppet::SSL::Host.localhost
   end
 
   it "should be able to verify its certificate matches its key" do
     Puppet::SSL::Host.new("foo").should respond_to(:certificate_matches_key?)
   end
 
   it "should consider the certificate invalid if it cannot find a key" do
     host = Puppet::SSL::Host.new("foo")
     host.expects(:key).returns nil
 
     host.should_not be_certificate_matches_key
   end
 
   it "should consider the certificate invalid if it cannot find a certificate" do
     host = Puppet::SSL::Host.new("foo")
     host.expects(:key).returns mock("key")
     host.expects(:certificate).returns nil
 
     host.should_not be_certificate_matches_key
   end
 
   it "should consider the certificate invalid if the SSL certificate's key verification fails" do
     host = Puppet::SSL::Host.new("foo")
 
     key = mock 'key', :content => "private_key"
     sslcert = mock 'sslcert'
     certificate = mock 'cert', :content => sslcert
 
     host.stubs(:key).returns key
     host.stubs(:certificate).returns certificate
 
     sslcert.expects(:check_private_key).with("private_key").returns false
 
     host.should_not be_certificate_matches_key
   end
 
   it "should consider the certificate valid if the SSL certificate's key verification succeeds" do
     host = Puppet::SSL::Host.new("foo")
 
     key = mock 'key', :content => "private_key"
     sslcert = mock 'sslcert'
     certificate = mock 'cert', :content => sslcert
 
     host.stubs(:key).returns key
     host.stubs(:certificate).returns certificate
 
     sslcert.expects(:check_private_key).with("private_key").returns true
 
     host.should be_certificate_matches_key
   end
 
   describe "when specifying the CA location" do
     it "should support the location ':local'" do
       lambda { Puppet::SSL::Host.ca_location = :local }.should_not raise_error
     end
 
     it "should support the location ':remote'" do
       lambda { Puppet::SSL::Host.ca_location = :remote }.should_not raise_error
     end
 
     it "should support the location ':none'" do
       lambda { Puppet::SSL::Host.ca_location = :none }.should_not raise_error
     end
 
     it "should support the location ':only'" do
       lambda { Puppet::SSL::Host.ca_location = :only }.should_not raise_error
     end
 
     it "should not support other modes" do
       lambda { Puppet::SSL::Host.ca_location = :whatever }.should raise_error(ArgumentError)
     end
 
     describe "as 'local'" do
       before do
         Puppet::SSL::Host.ca_location = :local
       end
 
       it "should set the cache class for Certificate, CertificateRevocationList, and CertificateRequest as :file" do
         Puppet::SSL::Certificate.indirection.cache_class.should == :file
         Puppet::SSL::CertificateRequest.indirection.cache_class.should == :file
         Puppet::SSL::CertificateRevocationList.indirection.cache_class.should == :file
       end
 
       it "should set the terminus class for Key and Host as :file" do
         Puppet::SSL::Key.indirection.terminus_class.should == :file
         Puppet::SSL::Host.indirection.terminus_class.should == :file
       end
 
       it "should set the terminus class for Certificate, CertificateRevocationList, and CertificateRequest as :ca" do
         Puppet::SSL::Certificate.indirection.terminus_class.should == :ca
         Puppet::SSL::CertificateRequest.indirection.terminus_class.should == :ca
         Puppet::SSL::CertificateRevocationList.indirection.terminus_class.should == :ca
       end
     end
 
     describe "as 'remote'" do
       before do
         Puppet::SSL::Host.ca_location = :remote
       end
 
       it "should set the cache class for Certificate, CertificateRevocationList, and CertificateRequest as :file" do
         Puppet::SSL::Certificate.indirection.cache_class.should == :file
         Puppet::SSL::CertificateRequest.indirection.cache_class.should == :file
         Puppet::SSL::CertificateRevocationList.indirection.cache_class.should == :file
       end
 
       it "should set the terminus class for Key as :file" do
         Puppet::SSL::Key.indirection.terminus_class.should == :file
       end
 
       it "should set the terminus class for Host, Certificate, CertificateRevocationList, and CertificateRequest as :rest" do
         Puppet::SSL::Host.indirection.terminus_class.should == :rest
         Puppet::SSL::Certificate.indirection.terminus_class.should == :rest
         Puppet::SSL::CertificateRequest.indirection.terminus_class.should == :rest
         Puppet::SSL::CertificateRevocationList.indirection.terminus_class.should == :rest
       end
     end
 
     describe "as 'only'" do
       before do
         Puppet::SSL::Host.ca_location = :only
       end
 
       it "should set the terminus class for Key, Certificate, CertificateRevocationList, and CertificateRequest as :ca" do
         Puppet::SSL::Key.indirection.terminus_class.should == :ca
         Puppet::SSL::Certificate.indirection.terminus_class.should == :ca
         Puppet::SSL::CertificateRequest.indirection.terminus_class.should == :ca
         Puppet::SSL::CertificateRevocationList.indirection.terminus_class.should == :ca
       end
 
       it "should set the cache class for Certificate, CertificateRevocationList, and CertificateRequest to nil" do
         Puppet::SSL::Certificate.indirection.cache_class.should be_nil
         Puppet::SSL::CertificateRequest.indirection.cache_class.should be_nil
         Puppet::SSL::CertificateRevocationList.indirection.cache_class.should be_nil
       end
 
       it "should set the terminus class for Host to :file" do
         Puppet::SSL::Host.indirection.terminus_class.should == :file
       end
     end
 
     describe "as 'none'" do
       before do
         Puppet::SSL::Host.ca_location = :none
       end
 
       it "should set the terminus class for Key, Certificate, CertificateRevocationList, and CertificateRequest as :file" do
         Puppet::SSL::Key.indirection.terminus_class.should == :file
         Puppet::SSL::Certificate.indirection.terminus_class.should == :file
         Puppet::SSL::CertificateRequest.indirection.terminus_class.should == :file
         Puppet::SSL::CertificateRevocationList.indirection.terminus_class.should == :file
       end
 
       it "should set the terminus class for Host to 'none'" do
         lambda { Puppet::SSL::Host.indirection.terminus_class }.should raise_error(Puppet::DevError)
       end
     end
   end
 
   it "should have a class method for destroying all files related to a given host" do
     Puppet::SSL::Host.should respond_to(:destroy)
   end
 
   describe "when destroying a host's SSL files" do
     before do
       Puppet::SSL::Key.indirection.stubs(:destroy).returns false
       Puppet::SSL::Certificate.indirection.stubs(:destroy).returns false
       Puppet::SSL::CertificateRequest.indirection.stubs(:destroy).returns false
     end
 
     it "should destroy its certificate, certificate request, and key" do
       Puppet::SSL::Key.indirection.expects(:destroy).with("myhost")
       Puppet::SSL::Certificate.indirection.expects(:destroy).with("myhost")
       Puppet::SSL::CertificateRequest.indirection.expects(:destroy).with("myhost")
 
       Puppet::SSL::Host.destroy("myhost")
     end
 
     it "should return true if any of the classes returned true" do
       Puppet::SSL::Certificate.indirection.expects(:destroy).with("myhost").returns true
 
       Puppet::SSL::Host.destroy("myhost").should be_true
     end
 
     it "should report that nothing was deleted if none of the classes returned true" do
       Puppet::SSL::Host.destroy("myhost").should == "Nothing was deleted"
     end
   end
 
   describe "when initializing" do
     it "should default its name to the :certname setting" do
       Puppet.settings.expects(:value).with(:certname).returns "myname"
 
       Puppet::SSL::Host.new.name.should == "myname"
     end
 
     it "should downcase a passed in name" do
       Puppet::SSL::Host.new("Host.Domain.Com").name.should == "host.domain.com"
     end
 
     it "should downcase the certname if it's used" do
       Puppet.settings.expects(:value).with(:certname).returns "Host.Domain.Com"
       Puppet::SSL::Host.new.name.should == "host.domain.com"
     end
 
     it "should indicate that it is a CA host if its name matches the ca_name constant" do
       Puppet::SSL::Host.stubs(:ca_name).returns "myca"
       Puppet::SSL::Host.new("myca").should be_ca
     end
   end
 
   describe "when managing its private key" do
     before do
       @realkey = "mykey"
       @key = Puppet::SSL::Key.new("mykey")
       @key.content = @realkey
     end
 
     it "should return nil if the key is not set and cannot be found" do
       Puppet::SSL::Key.indirection.expects(:find).with("myname").returns(nil)
       @host.key.should be_nil
     end
 
     it "should find the key in the Key class and return the Puppet instance" do
       Puppet::SSL::Key.indirection.expects(:find).with("myname").returns(@key)
       @host.key.should equal(@key)
     end
 
     it "should be able to generate and save a new key" do
       Puppet::SSL::Key.expects(:new).with("myname").returns(@key)
 
       @key.expects(:generate)
       Puppet::SSL::Key.indirection.expects(:save)
 
       @host.generate_key.should be_true
       @host.key.should equal(@key)
     end
 
     it "should not retain keys that could not be saved" do
       Puppet::SSL::Key.expects(:new).with("myname").returns(@key)
 
       @key.stubs(:generate)
       Puppet::SSL::Key.indirection.expects(:save).raises "eh"
 
       lambda { @host.generate_key }.should raise_error
       @host.key.should be_nil
     end
 
     it "should return any previously found key without requerying" do
       Puppet::SSL::Key.indirection.expects(:find).with("myname").returns(@key).once
       @host.key.should equal(@key)
       @host.key.should equal(@key)
     end
   end
 
   describe "when managing its certificate request" do
     before do
       @realrequest = "real request"
       @request = Puppet::SSL::CertificateRequest.new("myname")
       @request.content = @realrequest
     end
 
     it "should return nil if the key is not set and cannot be found" do
       Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myname").returns(nil)
       @host.certificate_request.should be_nil
     end
 
     it "should find the request in the Key class and return it and return the Puppet SSL request" do
       Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myname").returns @request
 
       @host.certificate_request.should equal(@request)
     end
 
     it "should generate a new key when generating the cert request if no key exists" do
       Puppet::SSL::CertificateRequest.expects(:new).with("myname").returns @request
 
       key = stub 'key', :public_key => mock("public_key"), :content => "mycontent"
 
       @host.expects(:key).times(2).returns(nil).then.returns(key)
       @host.expects(:generate_key).returns(key)
 
       @request.stubs(:generate)
       Puppet::SSL::CertificateRequest.indirection.stubs(:save)
 
       @host.generate_certificate_request
     end
 
     it "should be able to generate and save a new request using the private key" do
       Puppet::SSL::CertificateRequest.expects(:new).with("myname").returns @request
 
       key = stub 'key', :public_key => mock("public_key"), :content => "mycontent"
       @host.stubs(:key).returns(key)
       @request.expects(:generate).with("mycontent")
       Puppet::SSL::CertificateRequest.indirection.expects(:save).with(@request)
 
       @host.generate_certificate_request.should be_true
       @host.certificate_request.should equal(@request)
     end
 
     it "should return any previously found request without requerying" do
       Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myname").returns(@request).once
 
       @host.certificate_request.should equal(@request)
       @host.certificate_request.should equal(@request)
     end
 
     it "should not keep its certificate request in memory if the request cannot be saved" do
       Puppet::SSL::CertificateRequest.expects(:new).with("myname").returns @request
 
       key = stub 'key', :public_key => mock("public_key"), :content => "mycontent"
       @host.stubs(:key).returns(key)
       @request.stubs(:generate)
       @request.stubs(:name).returns("myname")
       terminus = stub 'terminus'
       Puppet::SSL::CertificateRequest.indirection.expects(:prepare).returns(terminus)
       terminus.expects(:save).with { |req| req.instance == @request && req.key == "myname" }.raises "eh"
 
       lambda { @host.generate_certificate_request }.should raise_error
 
       @host.instance_eval { @certificate_request }.should be_nil
     end
   end
 
   describe "when managing its certificate" do
     before do
       @realcert = mock 'certificate'
       @cert = stub 'cert', :content => @realcert
 
       @host.stubs(:key).returns mock("key")
       @host.stubs(:certificate_matches_key?).returns true
     end
 
     it "should find the CA certificate if it does not have a certificate" do
       Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME).returns mock("cacert")
       Puppet::SSL::Certificate.indirection.stubs(:find).with("myname").returns @cert
 
       @host.certificate
     end
 
     it "should not find the CA certificate if it is the CA host" do
       @host.expects(:ca?).returns true
       Puppet::SSL::Certificate.indirection.stubs(:find)
       Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME).never
 
       @host.certificate
     end
 
     it "should return nil if it cannot find a CA certificate" do
       Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME).returns nil
       Puppet::SSL::Certificate.indirection.expects(:find).with("myname").never
 
       @host.certificate.should be_nil
     end
 
     it "should find the key if it does not have one" do
       Puppet::SSL::Certificate.indirection.stubs(:find)
       @host.expects(:key).returns mock("key")
 
       @host.certificate
     end
 
     it "should generate the key if one cannot be found" do
       Puppet::SSL::Certificate.indirection.stubs(:find)
 
       @host.expects(:key).returns nil
       @host.expects(:generate_key)
 
       @host.certificate
     end
 
     it "should find the certificate in the Certificate class and return the Puppet certificate instance" do
       Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME).returns mock("cacert")
       Puppet::SSL::Certificate.indirection.expects(:find).with("myname").returns @cert
 
       @host.certificate.should equal(@cert)
     end
 
     it "should fail if the found certificate does not match the private key" do
       @host.expects(:certificate_matches_key?).returns false
 
       Puppet::SSL::Certificate.indirection.stubs(:find).returns @cert
 
       lambda { @host.certificate }.should raise_error(Puppet::Error)
     end
 
     it "should return any previously found certificate" do
       Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME).returns mock("cacert")
       Puppet::SSL::Certificate.indirection.expects(:find).with("myname").returns(@cert).once
 
       @host.certificate.should equal(@cert)
       @host.certificate.should equal(@cert)
     end
   end
 
   it "should have a method for listing certificate hosts" do
     Puppet::SSL::Host.should respond_to(:search)
   end
 
   describe "when listing certificate hosts" do
     it "should default to listing all clients with any file types" do
       Puppet::SSL::Key.indirection.expects(:search).returns []
       Puppet::SSL::Certificate.indirection.expects(:search).returns []
       Puppet::SSL::CertificateRequest.indirection.expects(:search).returns []
       Puppet::SSL::Host.search
     end
 
     it "should be able to list only clients with a key" do
       Puppet::SSL::Key.indirection.expects(:search).returns []
       Puppet::SSL::Certificate.indirection.expects(:search).never
       Puppet::SSL::CertificateRequest.indirection.expects(:search).never
       Puppet::SSL::Host.search :for => Puppet::SSL::Key
     end
 
     it "should be able to list only clients with a certificate" do
       Puppet::SSL::Key.indirection.expects(:search).never
       Puppet::SSL::Certificate.indirection.expects(:search).returns []
       Puppet::SSL::CertificateRequest.indirection.expects(:search).never
       Puppet::SSL::Host.search :for => Puppet::SSL::Certificate
     end
 
     it "should be able to list only clients with a certificate request" do
       Puppet::SSL::Key.indirection.expects(:search).never
       Puppet::SSL::Certificate.indirection.expects(:search).never
       Puppet::SSL::CertificateRequest.indirection.expects(:search).returns []
       Puppet::SSL::Host.search :for => Puppet::SSL::CertificateRequest
     end
 
     it "should return a Host instance created with the name of each found instance", :'fails_on_ruby_1.9.2' => true do
       key = stub 'key', :name => "key"
       cert = stub 'cert', :name => "cert"
       csr = stub 'csr', :name => "csr"
 
       Puppet::SSL::Key.indirection.expects(:search).returns [key]
       Puppet::SSL::Certificate.indirection.expects(:search).returns [cert]
       Puppet::SSL::CertificateRequest.indirection.expects(:search).returns [csr]
 
       returned = []
       %w{key cert csr}.each do |name|
         result = mock(name)
         returned << result
         Puppet::SSL::Host.expects(:new).with(name).returns result
       end
 
       result = Puppet::SSL::Host.search
       returned.each do |r|
         result.should be_include(r)
       end
     end
   end
 
   it "should have a method for generating all necessary files" do
     Puppet::SSL::Host.new("me").should respond_to(:generate)
   end
 
   describe "when generating files" do
     before do
       @host = Puppet::SSL::Host.new("me")
       @host.stubs(:generate_key)
       @host.stubs(:generate_certificate_request)
     end
 
     it "should generate a key if one is not present" do
       @host.stubs(:key).returns nil
       @host.expects(:generate_key)
 
       @host.generate
     end
 
     it "should generate a certificate request if one is not present" do
       @host.expects(:certificate_request).returns nil
       @host.expects(:generate_certificate_request)
 
       @host.generate
     end
 
     describe "and it can create a certificate authority" do
       before do
         @ca = mock 'ca'
         Puppet::SSL::CertificateAuthority.stubs(:instance).returns @ca
       end
 
       it "should use the CA to sign its certificate request if it does not have a certificate" do
         @host.expects(:certificate).returns nil
 
         @ca.expects(:sign).with(@host.name)
 
         @host.generate
       end
     end
 
     describe "and it cannot create a certificate authority" do
       before do
         Puppet::SSL::CertificateAuthority.stubs(:instance).returns nil
       end
 
       it "should seek its certificate" do
         @host.expects(:certificate)
 
         @host.generate
       end
     end
   end
 
   it "should have a method for creating an SSL store" do
     Puppet::SSL::Host.new("me").should respond_to(:ssl_store)
   end
 
   it "should always return the same store" do
     host = Puppet::SSL::Host.new("foo")
     store = mock 'store'
     store.stub_everything
     OpenSSL::X509::Store.expects(:new).returns store
     host.ssl_store.should equal(host.ssl_store)
   end
 
   describe "when creating an SSL store" do
     before do
       @host = Puppet::SSL::Host.new("me")
       @store = mock 'store'
       @store.stub_everything
       OpenSSL::X509::Store.stubs(:new).returns @store
 
       Puppet.settings.stubs(:value).with(:localcacert).returns "ssl_host_testing"
 
       Puppet::SSL::CertificateRevocationList.indirection.stubs(:find).returns(nil)
     end
 
     it "should accept a purpose" do
       @store.expects(:purpose=).with "my special purpose"
       @host.ssl_store("my special purpose")
     end
 
     it "should default to OpenSSL::X509::PURPOSE_ANY as the purpose" do
       @store.expects(:purpose=).with OpenSSL::X509::PURPOSE_ANY
       @host.ssl_store
     end
 
     it "should add the local CA cert file" do
       Puppet.settings.stubs(:value).with(:localcacert).returns "/ca/cert/file"
       @store.expects(:add_file).with "/ca/cert/file"
       @host.ssl_store
     end
 
     describe "and a CRL is available" do
       before do
         @crl = stub 'crl', :content => "real_crl"
         Puppet::SSL::CertificateRevocationList.indirection.stubs(:find).returns @crl
         Puppet.settings.stubs(:value).with(:certificate_revocation).returns true
       end
 
       it "should add the CRL" do
         @store.expects(:add_crl).with "real_crl"
         @host.ssl_store
       end
 
       it "should set the flags to OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK" do
         @store.expects(:flags=).with OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK
         @host.ssl_store
       end
     end
   end
 
   describe "when waiting for a cert" do
     before do
       @host = Puppet::SSL::Host.new("me")
     end
 
     it "should generate its certificate request and attempt to read the certificate again if no certificate is found" do
       @host.expects(:certificate).times(2).returns(nil).then.returns "foo"
       @host.expects(:generate)
       @host.wait_for_cert(1)
     end
 
     it "should catch and log errors during CSR saving" do
       @host.expects(:certificate).times(2).returns(nil).then.returns "foo"
       @host.expects(:generate).raises(RuntimeError).then.returns nil
       @host.stubs(:sleep)
       @host.wait_for_cert(1)
     end
 
     it "should sleep and retry after failures saving the CSR if waitforcert is enabled" do
       @host.expects(:certificate).times(2).returns(nil).then.returns "foo"
       @host.expects(:generate).raises(RuntimeError).then.returns nil
       @host.expects(:sleep).with(1)
       @host.wait_for_cert(1)
     end
 
     it "should exit after failures saving the CSR of waitforcert is disabled" do
       @host.expects(:certificate).returns(nil)
       @host.expects(:generate).raises(RuntimeError)
       @host.expects(:puts)
       expect { @host.wait_for_cert(0) }.to exit_with 1
     end
 
     it "should exit if the wait time is 0 and it can neither find nor retrieve a certificate" do
       @host.stubs(:certificate).returns nil
       @host.expects(:generate)
       @host.expects(:puts)
       expect { @host.wait_for_cert(0) }.to exit_with 1
     end
 
     it "should sleep for the specified amount of time if no certificate is found after generating its certificate request" do
       @host.expects(:certificate).times(3).returns(nil).then.returns(nil).then.returns "foo"
       @host.expects(:generate)
 
       @host.expects(:sleep).with(1)
 
       @host.wait_for_cert(1)
     end
 
     it "should catch and log exceptions during certificate retrieval" do
       @host.expects(:certificate).times(3).returns(nil).then.raises(RuntimeError).then.returns("foo")
       @host.stubs(:generate)
       @host.stubs(:sleep)
 
       Puppet.expects(:err)
 
       @host.wait_for_cert(1)
     end
   end
 
-  describe "when handling PSON" do
+  describe "when handling PSON", :unless => Puppet.features.microsoft_windows? do
     include PuppetSpec::Files
 
     before do
       Puppet[:vardir] = tmpdir("ssl_test_vardir")
       Puppet[:ssldir] = tmpdir("ssl_test_ssldir")
       Puppet::SSLCertificates::CA.new.mkrootcert
       # localcacert is where each client stores the CA certificate
       # cacert is where the master stores the CA certificate
       # Since we need to play the role of both for testing we need them to be the same and exist
       Puppet[:cacert] = Puppet[:localcacert]
 
       @ca=Puppet::SSL::CertificateAuthority.new
     end
 
     describe "when converting to PSON" do
       it "should be able to identify a host with an unsigned certificate request" do
         host = Puppet::SSL::Host.new("bazinga")
         host.generate_certificate_request
         pson_hash = {
           "fingerprint"          => host.certificate_request.fingerprint,
           "desired_state"        => 'requested',
           "name"                 => host.name
         }
 
         result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
         result["fingerprint"].should == pson_hash["fingerprint"]
         result["name"].should        == pson_hash["name"]
         result["state"].should       == pson_hash["desired_state"]
       end
 
       it "should be able to identify a host with a signed certificate" do
         host = Puppet::SSL::Host.new("bazinga")
         host.generate_certificate_request
         @ca.sign(host.name)
         pson_hash = {
           "fingerprint"          => Puppet::SSL::Certificate.indirection.find(host.name).fingerprint,
           "desired_state"        => 'signed',
           "name"                 => host.name,
         }
 
         result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
         result["fingerprint"].should == pson_hash["fingerprint"]
         result["name"].should        == pson_hash["name"]
         result["state"].should       == pson_hash["desired_state"]
       end
 
       it "should be able to identify a host with a revoked certificate" do
         host = Puppet::SSL::Host.new("bazinga")
         host.generate_certificate_request
         @ca.sign(host.name)
         @ca.revoke(host.name)
         pson_hash = {
           "fingerprint"          => Puppet::SSL::Certificate.indirection.find(host.name).fingerprint,
           "desired_state"        => 'revoked',
           "name"                 => host.name,
         }
 
         result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
         result["fingerprint"].should == pson_hash["fingerprint"]
         result["name"].should        == pson_hash["name"]
         result["state"].should       == pson_hash["desired_state"]
       end
     end
 
     describe "when converting from PSON" do
       it "should return a Puppet::SSL::Host object with the specified desired state" do
         host = Puppet::SSL::Host.new("bazinga")
         host.desired_state="signed"
         pson_hash = {
           "name"  => host.name,
           "desired_state" => host.desired_state,
         }
         generated_host = Puppet::SSL::Host.from_pson(pson_hash)
         generated_host.desired_state.should == host.desired_state
         generated_host.name.should == host.name
       end
     end
   end
 end
diff --git a/spec/unit/sslcertificates/ca_spec.rb b/spec/unit/sslcertificates/ca_spec.rb
index 2ff4036dd..7a687b825 100755
--- a/spec/unit/sslcertificates/ca_spec.rb
+++ b/spec/unit/sslcertificates/ca_spec.rb
@@ -1,110 +1,106 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'puppet'
 require 'puppet/sslcertificates'
 require 'puppet/sslcertificates/ca'
 
-describe Puppet::SSLCertificates::CA, :fails_on_windows => true do
+describe Puppet::SSLCertificates::CA, :unless => Puppet.features.microsoft_windows? do
+  include PuppetSpec::Files
+
   before :all do
     @hosts = %w{host.domain.com Other.Testing.Com}
   end
 
   before :each do
     Puppet::Util::SUIDManager.stubs(:asuser).yields
-    file = Tempfile.new("ca_testing")
-    @dir = file.path
-    file.delete
+    dir = tmpdir("ca_testing")
 
-    Puppet.settings[:confdir] = @dir
-    Puppet.settings[:vardir]  = @dir
+    Puppet.settings[:confdir] = dir
+    Puppet.settings[:vardir]  = dir
 
     @ca = Puppet::SSLCertificates::CA.new
   end
 
-  after :each do
-    system("rm -rf #{@dir}")
-  end
-
   describe 'when cleaning' do
     it 'should remove associated files' do
       dirs = [:csrdir, :signeddir, :publickeydir, :privatekeydir, :certdir]
 
       @hosts.each do |host|
         files = []
         dirs.each do |dir|
           dir = Puppet[dir]
 
           # Case insensitivity is handled through downcasing
           file = File.join(dir, host.downcase + '.pem')
 
           File.open(file, "w") do |f|
             f.puts "testing"
           end
 
           files << file
         end
 
         lambda { @ca.clean(host) }.should_not raise_error
 
         files.reject {|f| ! File.exists?(f)}.should be_empty
       end
     end
   end
 
   describe 'when mapping hosts to files' do
     it 'should correctly return the certfile' do
       @hosts.each do |host|
         value = nil
         lambda { value = @ca.host2certfile host }.should_not raise_error
 
         File.join(Puppet[:signeddir], host.downcase + '.pem').should == value
       end
     end
 
     it 'should correctly return the csrfile' do
       @hosts.each do |host|
         value = nil
         lambda { value = @ca.host2csrfile host }.should_not raise_error
 
         File.join(Puppet[:csrdir], host.downcase + '.pem').should == value
       end
     end
   end
 
   describe 'when listing' do
     it 'should find all csr' do
       list = []
 
       # Make some fake CSRs
       @hosts.each do |host|
         file = File.join(Puppet[:csrdir], host.downcase + '.pem')
         File.open(file, 'w') { |f| f.puts "yay" }
         list << host.downcase
       end
 
       @ca.list.sort.should == list.sort
     end
   end
 
   describe 'when creating a root certificate' do
     before :each do
       lambda { @ca.mkrootcert }.should_not raise_exception
     end
 
     it 'should store the public key' do
       File.exists?(Puppet[:capub]).should be_true
     end
 
     it 'should prepend "Puppet CA: " to the fqdn as the ca_name by default' do
       host_mock_fact = mock()
       host_mock_fact.expects(:value).returns('myhost')
       domain_mock_fact = mock()
       domain_mock_fact.expects(:value).returns('puppetlabs.lan')
       Facter.stubs(:[]).with('hostname').returns(host_mock_fact)
       Facter.stubs(:[]).with('domain').returns(domain_mock_fact)
 
       @ca.mkrootcert.name.should == 'Puppet CA: myhost.puppetlabs.lan'
     end
   end
 end