diff --git a/lib/puppet/indirector/rest.rb b/lib/puppet/indirector/rest.rb
index 19daff51d..c8a45d76d 100644
--- a/lib/puppet/indirector/rest.rb
+++ b/lib/puppet/indirector/rest.rb
@@ -1,160 +1,160 @@
 require 'net/http'
 require 'uri'
 
 require 'puppet/network/http_pool'
 require 'puppet/network/http/api/v1'
 require 'puppet/network/http/compression'
 
 # Access objects via REST
 class Puppet::Indirector::REST < Puppet::Indirector::Terminus
   include Puppet::Network::HTTP::API::V1
   include Puppet::Network::HTTP::Compression.module
 
   class << self
     attr_reader :server_setting, :port_setting
   end
 
   # Specify the setting that we should use to get the server name.
   def self.use_server_setting(setting)
     @server_setting = setting
   end
 
   def self.server
     Puppet.settings[server_setting || :server]
   end
 
   # Specify the setting that we should use to get the port.
   def self.use_port_setting(setting)
     @port_setting = setting
   end
 
   def self.port
     Puppet.settings[port_setting || :masterport].to_i
   end
 
   # Figure out the content type, turn that into a format, and use the format
   # to extract the body of the response.
   def deserialize(response, multiple = false)
     case response.code
     when "404"
       return nil
     when /^2/
       raise "No content type in http response; cannot parse" unless response['content-type']
 
       content_type = response['content-type'].gsub(/\s*;.*$/,'') # strip any appended charset
 
       body = uncompress_body(response)
 
       # Convert the response to a deserialized object.
       if multiple
         model.convert_from_multiple(content_type, body)
       else
         model.convert_from(content_type, body)
       end
     else
       # Raise the http error if we didn't get a 'success' of some kind.
       raise convert_to_http_error(response)
     end
   end
 
   def convert_to_http_error(response)
     message = "Error #{response.code} on SERVER: #{(response.body||'').empty? ? response.message : uncompress_body(response)}"
     Net::HTTPError.new(message, response)
   end
 
   # Provide appropriate headers.
   def headers
     add_accept_encoding({"Accept" => model.supported_formats.join(", ")})
   end
 
   def network(request)
     Puppet::Network::HttpPool.http_instance(request.server || self.class.server, request.port || self.class.port)
   end
 
   [:get, :post, :head, :delete, :put].each do |method|
     define_method "http_#{method}" do |request, *args|
       http_request(method, request, *args)
     end
   end
 
   def http_request(method, request, *args)
     http_connection = network(request)
     peer_certs = []
 
     # We add the callback to collect the certificates for use in constructing
     # the error message if the verification failed.  This is necessary since we
     # don't have direct access to the cert that we expected the connection to
     # use otherwise.
     #
     http_connection.verify_callback = proc do |preverify_ok, ssl_context|
       peer_certs << Puppet::SSL::Certificate.from_s(ssl_context.current_cert.to_pem)
       preverify_ok
     end
 
     http_connection.send(method, *args)
   rescue OpenSSL::SSL::SSLError => error
     if error.message.include? "certificate verify failed"
       raise Puppet::Error, "#{error.message}.  This is often because the time is out of sync on the server or client"
     elsif error.message.include? "hostname was not match"
       raise unless cert = peer_certs.find { |c| c.name !~ /^puppet ca/i }
 
-      valid_certnames = [cert.name, *cert.alternate_names].uniq
+      valid_certnames = [cert.name, *cert.subject_alt_names].uniq
       msg = valid_certnames.length > 1 ? "one of #{valid_certnames.join(', ')}" : valid_certnames.first
 
       raise Puppet::Error, "Server hostname '#{http_connection.address}' did not match server certificate; expected #{msg}"
     else
       raise
     end
   end
 
   def find(request)
     uri, body = request_to_uri_and_body(request)
     uri_with_query_string = "#{uri}?#{body}"
     # WEBrick in Ruby 1.9.1 only supports up to 1024 character lines in an HTTP request
     # http://redmine.ruby-lang.org/issues/show/3991
     response = if "GET #{uri_with_query_string} HTTP/1.1\r\n".length > 1024
       http_post(request, uri, body, headers)
     else
       http_get(request, uri_with_query_string, headers)
     end
     result = deserialize response
     result.name = request.key if result.respond_to?(:name=)
     result
   end
 
   def head(request)
     response = http_head(request, indirection2uri(request), headers)
     case response.code
     when "404"
       return false
     when /^2/
       return true
     else
       # Raise the http error if we didn't get a 'success' of some kind.
       raise convert_to_http_error(response)
     end
   end
 
   def search(request)
     unless result = deserialize(http_get(request, indirection2uri(request), headers), true)
       return []
     end
     result
   end
 
   def destroy(request)
     raise ArgumentError, "DELETE does not accept options" unless request.options.empty?
     deserialize http_delete(request, indirection2uri(request), headers)
   end
 
   def save(request)
     raise ArgumentError, "PUT does not accept options" unless request.options.empty?
     deserialize http_put(request, indirection2uri(request), request.instance.render, headers.merge({ "Content-Type" => request.instance.mime }))
   end
 
   private
 
   def environment
     Puppet::Node::Environment.new
   end
 end
diff --git a/lib/puppet/network/handler/ca.rb b/lib/puppet/network/handler/ca.rb
index 1dabeee2f..a61f62faf 100644
--- a/lib/puppet/network/handler/ca.rb
+++ b/lib/puppet/network/handler/ca.rb
@@ -1,61 +1,61 @@
 require 'openssl'
 require 'puppet'
 require 'xmlrpc/server'
 require 'puppet/network/handler'
 
 class Puppet::Network::Handler
   class CA < Handler
     attr_reader :ca
 
     desc "Provides an interface for signing CSRs.  Accepts a CSR and returns
     the CA certificate and the signed certificate, or returns nil if
     the cert is not signed."
 
     @interface = XMLRPC::Service::Interface.new("puppetca") { |iface|
       iface.add_method("array getcert(csr)")
     }
 
     def initialize(hash = {})
       Puppet.settings.use(:main, :ssl, :ca)
 
       @ca = Puppet::SSL::CertificateAuthority.instance
     end
 
     # our client sends us a csr, and we either store it for later signing,
     # or we sign it right away
     def getcert(csrtext, client = nil, clientip = nil)
       csr = Puppet::SSL::CertificateRequest.from_s(csrtext)
       hostname = csr.name
 
       unless @ca
         Puppet.notice "Host #{hostname} asked for signing from non-CA master"
         return ""
       end
 
       # We used to save the public key, but it's basically unnecessary
       # and it mucks with the permissions requirements.
 
       # first check to see if we already have a signed cert for the host
-      cert = Puppet::SSL::Certificate.find(hostname)
-      cacert = Puppet::SSL::Certificate.find(@ca.host.name)
+      cert = Puppet::SSL::Certificate.indirection.find(hostname)
+      cacert = Puppet::SSL::Certificate.indirection.find(@ca.host.name)
 
       if cert
         Puppet.info "Retrieving existing certificate for #{hostname}"
         unless csr.content.public_key.to_s == cert.content.public_key.to_s
           raise Puppet::Error, "Certificate request does not match existing certificate; run 'puppetca --clean #{hostname}'."
         end
         [cert.to_s, cacert.to_s]
       else
-        csr.save
+        Puppet::SSL::CertificateRequest.indirection.save(csr)
 
         # We determine whether we signed the csr by checking if there's a certificate for it
-        if cert = Puppet::SSL::Certificate.find(hostname)
+        if cert = Puppet::SSL::Certificate.indirection.find(hostname)
           [cert.to_s, cacert.to_s]
         else
           nil
         end
       end
     end
   end
 end
 
diff --git a/spec/unit/indirector/certificate_request/ca_spec.rb b/spec/unit/indirector/certificate_request/ca_spec.rb
index 9c74f09d1..e5443a26d 100755
--- a/spec/unit/indirector/certificate_request/ca_spec.rb
+++ b/spec/unit/indirector/certificate_request/ca_spec.rb
@@ -1,60 +1,57 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'puppet/ssl/host'
-require 'puppet/sslcertificates'
-require 'puppet/sslcertificates/ca'
 require 'puppet/indirector/certificate_request/ca'
 
 describe Puppet::SSL::CertificateRequest::Ca, :unless => Puppet.features.microsoft_windows? do
   include PuppetSpec::Files
 
   before :each do
     Puppet[:ssldir] = tmpdir('ssl')
 
     Puppet::SSL::Host.ca_location = :local
     Puppet[:localcacert] = Puppet[:cacert]
-    Puppet::SSLCertificates::CA.new.mkrootcert
 
     @ca = Puppet::SSL::CertificateAuthority.new
   end
 
   after :all do
     Puppet::SSL::Host.ca_location = :none
   end
 
   it "should have documentation" do
     Puppet::SSL::CertificateRequest::Ca.doc.should be_instance_of(String)
   end
 
   it "should use the :csrdir as the collection directory" do
     Puppet.settings.expects(:value).with(:csrdir).returns "/request/dir"
     Puppet::SSL::CertificateRequest::Ca.collection_directory.should == "/request/dir"
   end
 
   it "should overwrite the previous certificate request if allow_duplicate_certs is true" do
     Puppet[:allow_duplicate_certs] = true
     host = Puppet::SSL::Host.new("foo")
     host.generate_certificate_request
     @ca.sign(host.name)
 
     Puppet::SSL::Host.indirection.find("foo").generate_certificate_request
 
     Puppet::SSL::Certificate.indirection.find("foo").name.should == "foo"
     Puppet::SSL::CertificateRequest.indirection.find("foo").name.should == "foo"
     Puppet::SSL::Host.indirection.find("foo").state.should == "requested"
   end
 
   it "should reject a new certificate request if allow_duplicate_certs is false" do
     Puppet[:allow_duplicate_certs] = false
     host = Puppet::SSL::Host.new("bar")
     host.generate_certificate_request
     @ca.sign(host.name)
 
     expect { Puppet::SSL::Host.indirection.find("bar").generate_certificate_request }.should raise_error(/ignoring certificate request/)
 
     Puppet::SSL::Certificate.indirection.find("bar").name.should == "bar"
     Puppet::SSL::CertificateRequest.indirection.find("bar").should be_nil
     Puppet::SSL::Host.indirection.find("bar").state.should == "signed"
   end
 end
diff --git a/spec/unit/indirector/rest_spec.rb b/spec/unit/indirector/rest_spec.rb
index 042b7ca16..f0e04d339 100755
--- a/spec/unit/indirector/rest_spec.rb
+++ b/spec/unit/indirector/rest_spec.rb
@@ -1,568 +1,567 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 require 'puppet/indirector/rest'
 
 shared_examples_for "a REST http call" do
   it "should accept a path" do
     lambda { @search.send(@method, *@arguments) }.should_not raise_error(ArgumentError)
   end
 
   it "should require a path" do
     lambda { @searcher.send(@method) }.should raise_error(ArgumentError)
   end
 
   it "should return the results of deserializing the response to the request" do
     conn = mock 'connection'
     conn.stubs(:put).returns @response
     conn.stubs(:delete).returns @response
     conn.stubs(:get).returns @response
     Puppet::Network::HttpPool.stubs(:http_instance).returns conn
 
     @searcher.expects(:deserialize).with(@response).returns "myobject"
 
     @searcher.send(@method, *@arguments).should == 'myobject'
   end
 end
 
 describe Puppet::Indirector::REST do
   before :all do
     Puppet::Indirector::Terminus.stubs(:register_terminus_class)
     @model = stub('model', :supported_formats => %w{}, :convert_from => nil)
     @instance = stub('model instance', :name= => nil)
     @indirection = stub('indirection', :name => :mystuff, :register_terminus_type => nil, :model => @model)
     Puppet::Indirector::Indirection.expects(:instance).returns(@indirection)
 
     module This
       module Is
         module A
           module Test
           end
         end
       end
     end
     @rest_class = class This::Is::A::Test::Class < Puppet::Indirector::REST
       self
     end
   end
 
   before :each do
     @response = stub('mock response', :body => 'result', :code => "200")
     @response.stubs(:[]).with('content-type').returns "text/plain"
     @response.stubs(:[]).with('content-encoding').returns nil
 
     @searcher = @rest_class.new
     @searcher.stubs(:model).returns @model
   end
 
   it "should include the v1 REST API module" do
     Puppet::Indirector::REST.ancestors.should be_include(Puppet::Network::HTTP::API::V1)
   end
 
   it "should have a method for specifying what setting a subclass should use to retrieve its server" do
     @rest_class.should respond_to(:use_server_setting)
   end
 
   it "should use any specified setting to pick the server" do
     @rest_class.expects(:server_setting).returns :servset
     Puppet.settings.expects(:value).with(:servset).returns "myserver"
     @rest_class.server.should == "myserver"
   end
 
   it "should default to :server for the server setting" do
     @rest_class.expects(:server_setting).returns nil
     Puppet.settings.expects(:value).with(:server).returns "myserver"
     @rest_class.server.should == "myserver"
   end
 
   it "should have a method for specifying what setting a subclass should use to retrieve its port" do
     @rest_class.should respond_to(:use_port_setting)
   end
 
   it "should use any specified setting to pick the port" do
     @rest_class.expects(:port_setting).returns :servset
     Puppet.settings.expects(:value).with(:servset).returns "321"
     @rest_class.port.should == 321
   end
 
   it "should default to :port for the port setting" do
     @rest_class.expects(:port_setting).returns nil
     Puppet.settings.expects(:value).with(:masterport).returns "543"
     @rest_class.port.should == 543
   end
 
   describe "when making http requests" do
+    include PuppetSpec::Files
+
     it "should provide a suggestive error message when certificate verify failed" do
       connection = Net::HTTP.new('my_server', 8140)
       @searcher.stubs(:network).returns(connection)
 
       connection.stubs(:get).raises(OpenSSL::SSL::SSLError.new('certificate verify failed'))
 
       expect do
         @searcher.http_request(:get, stub('request'))
       end.to raise_error(/This is often because the time is out of sync on the server or client/)
     end
 
     it "should provide a helpful error message when hostname was not match with server certificate" do
-      Puppet[:certdnsnames] = 'foo:bar:baz'
-      csr            = OpenSSL::X509::Request.new
-      csr.subject    = OpenSSL::X509::Name.new([['CN', 'not_my_server']])
-      csr.public_key = OpenSSL::PKey::RSA.generate(Puppet[:keylength]).public_key
-      cert = Puppet::SSL::CertificateFactory.new('server', csr, csr, 14).result
+      Puppet[:confdir] = tmpdir('conf')
+      cert = Puppet::SSL::CertificateAuthority.new.generate('not_my_server', :dns_alt_names => 'foo,bar,baz').content
 
       connection = Net::HTTP.new('my_server', 8140)
       @searcher.stubs(:network).returns(connection)
       ssl_context = OpenSSL::SSL::SSLContext.new
       ssl_context.stubs(:current_cert).returns(cert)
       connection.stubs(:get).with do
         connection.verify_callback.call(true, ssl_context)
       end.raises(OpenSSL::SSL::SSLError.new('hostname was not match with server certificate'))
 
       msg = /Server hostname 'my_server' did not match server certificate; expected one of (.+)/
       expect { @searcher.http_request(:get, stub('request')) }.to(
         raise_error(Puppet::Error, msg) do |error|
           error.message =~ msg
-          $1.split(', ').should =~ ['foo', 'bar', 'baz', 'not_my_server']
+          $1.split(', ').should =~ %w[DNS:foo DNS:bar DNS:baz DNS:not_my_server not_my_server]
         end
       )
     end
 
     it "should pass along the error message otherwise" do
       connection = Net::HTTP.new('my_server', 8140)
       @searcher.stubs(:network).returns(connection)
 
       connection.stubs(:get).raises(OpenSSL::SSL::SSLError.new('some other message'))
 
       expect do
         @searcher.http_request(:get, stub('request'))
       end.to raise_error(/some other message/)
     end
   end
 
   describe "when deserializing responses" do
     it "should return nil if the response code is 404" do
       response = mock 'response'
       response.expects(:code).returns "404"
 
       @searcher.deserialize(response).should be_nil
     end
 
     [300,400,403,405,500,501,502,503,504].each { |rc|
       describe "when the response code is #{rc}" do
         before :each do
           @model.expects(:convert_from).never
 
           @response = mock 'response'
           @response.stubs(:code).returns rc.to_s
           @response.stubs(:[]).with('content-encoding').returns nil
           @response.stubs(:message).returns "There was a problem (header)"
         end
 
         it "should fail" do
           @response.stubs(:body).returns nil
           lambda { @searcher.deserialize(@response) }.should raise_error(Net::HTTPError)
         end
 
         it "should take the error message from the body, if present" do
           @response.stubs(:body).returns "There was a problem (body)"
           lambda { @searcher.deserialize(@response) }.should raise_error(Net::HTTPError,"Error #{rc} on SERVER: There was a problem (body)")
         end
 
         it "should take the error message from the response header if the body is empty" do
           @response.stubs(:body).returns ""
           lambda { @searcher.deserialize(@response) }.should raise_error(Net::HTTPError,"Error #{rc} on SERVER: There was a problem (header)")
         end
 
         it "should take the error message from the response header if the body is absent" do
           @response.stubs(:body).returns nil
           lambda { @searcher.deserialize(@response) }.should raise_error(Net::HTTPError,"Error #{rc} on SERVER: There was a problem (header)")
         end
 
         describe "and with http compression" do
           it "should uncompress the body" do
             @response.stubs(:body).returns("compressed body")
             @searcher.expects(:uncompress_body).with(@response).returns("uncompressed")
             lambda { @searcher.deserialize(@response) }.should raise_error { |e| e.message =~ /uncompressed/ }
           end
         end
       end
     }
 
     it "should return the results of converting from the format specified by the content-type header if the response code is in the 200s" do
       @model.expects(:convert_from).with("myformat", "mydata").returns "myobject"
 
       response = mock 'response'
       response.stubs(:[]).with("content-type").returns "myformat"
       response.stubs(:[]).with("content-encoding").returns nil
       response.stubs(:body).returns "mydata"
       response.stubs(:code).returns "200"
 
       @searcher.deserialize(response).should == "myobject"
     end
 
     it "should convert and return multiple instances if the return code is in the 200s and 'multiple' is specified" do
       @model.expects(:convert_from_multiple).with("myformat", "mydata").returns "myobjects"
 
       response = mock 'response'
       response.stubs(:[]).with("content-type").returns "myformat"
       response.stubs(:[]).with("content-encoding").returns nil
       response.stubs(:body).returns "mydata"
       response.stubs(:code).returns "200"
 
       @searcher.deserialize(response, true).should == "myobjects"
     end
 
     it "should strip the content-type header to keep only the mime-type" do
       @model.expects(:convert_from).with("text/plain", "mydata").returns "myobject"
 
       response = mock 'response'
       response.stubs(:[]).with("content-type").returns "text/plain; charset=utf-8"
       response.stubs(:[]).with("content-encoding").returns nil
       response.stubs(:body).returns "mydata"
       response.stubs(:code).returns "200"
 
       @searcher.deserialize(response)
     end
 
     it "should uncompress the body" do
       @model.expects(:convert_from).with("myformat", "uncompressed mydata").returns "myobject"
 
       response = mock 'response'
       response.stubs(:[]).with("content-type").returns "myformat"
       response.stubs(:body).returns "compressed mydata"
       response.stubs(:code).returns "200"
 
       @searcher.expects(:uncompress_body).with(response).returns("uncompressed mydata")
 
       @searcher.deserialize(response).should == "myobject"
     end
   end
 
   describe "when creating an HTTP client" do
     before do
       Puppet.settings.stubs(:value).returns("rest_testing")
     end
 
     it "should use the class's server and port if the indirection request provides neither" do
       @request = stub 'request', :key => "foo", :server => nil, :port => nil
       @searcher.class.expects(:port).returns 321
       @searcher.class.expects(:server).returns "myserver"
       Puppet::Network::HttpPool.expects(:http_instance).with("myserver", 321).returns "myconn"
       @searcher.network(@request).should == "myconn"
     end
 
     it "should use the server from the indirection request if one is present" do
       @request = stub 'request', :key => "foo", :server => "myserver", :port => nil
       @searcher.class.stubs(:port).returns 321
       Puppet::Network::HttpPool.expects(:http_instance).with("myserver", 321).returns "myconn"
       @searcher.network(@request).should == "myconn"
     end
 
     it "should use the port from the indirection request if one is present" do
       @request = stub 'request', :key => "foo", :server => nil, :port => 321
       @searcher.class.stubs(:server).returns "myserver"
       Puppet::Network::HttpPool.expects(:http_instance).with("myserver", 321).returns "myconn"
       @searcher.network(@request).should == "myconn"
     end
   end
 
   describe "when doing a find" do
     before :each do
       @connection = stub('mock http connection', :get => @response, :verify_callback= => nil)
       @searcher.stubs(:network).returns(@connection)    # neuter the network connection
 
       # Use a key with spaces, so we can test escaping
       @request = Puppet::Indirector::Request.new(:foo, :find, "foo bar", :environment => "myenv")
     end
 
     describe "with a large body" do
       it "should use the POST http method" do
         params = {}
         'aa'.upto('zz') do |s|
           params[s] = 'foo'
         end
 
         # The request special-cases this parameter, and it
         # won't be passed on to the server, so we remove it here
         # to avoid a failure.
         params.delete('ip')
 
         @request = Puppet::Indirector::Request.new(:foo, :find, "foo bar", params.merge(:environment => "myenv"))
 
         @connection.expects(:post).with do |uri, body|
           uri == "/myenv/foo/foo%20bar" and body.split("&").sort == params.map {|key,value| "#{key}=#{value}"}.sort
         end.returns(@response)
 
         @searcher.find(@request)
       end
     end
 
     describe "with a small body" do
       it "should use the GET http method" do
         @searcher.expects(:network).returns @connection
         @connection.expects(:get).returns @response
         @searcher.find(@request)
       end
     end
 
     it "should deserialize and return the http response, setting name" do
       @connection.expects(:get).returns @response
 
       instance = stub 'object'
       instance.expects(:name=)
       @searcher.expects(:deserialize).with(@response).returns instance
 
       @searcher.find(@request).should == instance
     end
 
     it "should deserialize and return the http response, and not require name=" do
       @connection.expects(:get).returns @response
 
       instance = stub 'object'
       @searcher.expects(:deserialize).with(@response).returns instance
 
       @searcher.find(@request).should == instance
     end
 
     it "should use the URI generated by the Handler module" do
       @connection.expects(:get).with { |path, args| path == "/myenv/foo/foo%20bar?" }.returns(@response)
       @searcher.find(@request)
     end
 
     it "should provide an Accept header containing the list of supported formats joined with commas" do
       @connection.expects(:get).with { |path, args| args["Accept"] == "supported, formats" }.returns(@response)
 
       @searcher.model.expects(:supported_formats).returns %w{supported formats}
       @searcher.find(@request)
     end
 
     it "should add Accept-Encoding header" do
       @searcher.expects(:add_accept_encoding).returns({"accept-encoding" => "gzip"})
 
       @connection.expects(:get).with { |path, args| args["accept-encoding"] == "gzip" }.returns(@response)
       @searcher.find(@request)
     end
 
     it "should deserialize and return the network response" do
       @searcher.expects(:deserialize).with(@response).returns @instance
       @searcher.find(@request).should equal(@instance)
     end
 
     it "should set the name of the resulting instance to the asked-for name" do
       @searcher.expects(:deserialize).with(@response).returns @instance
       @instance.expects(:name=).with "foo bar"
       @searcher.find(@request)
     end
 
     it "should generate an error when result data deserializes fails" do
       @searcher.expects(:deserialize).raises(ArgumentError)
       lambda { @searcher.find(@request) }.should raise_error(ArgumentError)
     end
   end
 
   describe "when doing a head" do
     before :each do
       @connection = stub('mock http connection', :head => @response, :verify_callback= => nil)
       @searcher.stubs(:network).returns(@connection)
 
       # Use a key with spaces, so we can test escaping
       @request = Puppet::Indirector::Request.new(:foo, :head, "foo bar")
     end
 
     it "should call the HEAD http method on a network connection" do
       @searcher.expects(:network).returns @connection
       @connection.expects(:head).returns @response
       @searcher.head(@request)
     end
 
     it "should return true if there was a successful http response" do
       @connection.expects(:head).returns @response
       @response.stubs(:code).returns "200"
 
       @searcher.head(@request).should == true
     end
 
     it "should return false if there was a successful http response" do
       @connection.expects(:head).returns @response
       @response.stubs(:code).returns "404"
 
       @searcher.head(@request).should == false
     end
 
     it "should use the URI generated by the Handler module" do
       @searcher.expects(:indirection2uri).with(@request).returns "/my/uri"
       @connection.expects(:head).with { |path, args| path == "/my/uri" }.returns(@response)
       @searcher.head(@request)
     end
   end
 
   describe "when doing a search" do
     before :each do
       @connection = stub('mock http connection', :get => @response, :verify_callback= => nil)
       @searcher.stubs(:network).returns(@connection)    # neuter the network connection
 
       @model.stubs(:convert_from_multiple)
 
       @request = Puppet::Indirector::Request.new(:foo, :search, "foo bar")
     end
 
     it "should call the GET http method on a network connection" do
       @searcher.expects(:network).returns @connection
       @connection.expects(:get).returns @response
       @searcher.search(@request)
     end
 
     it "should deserialize as multiple instances and return the http response" do
       @connection.expects(:get).returns @response
       @searcher.expects(:deserialize).with(@response, true).returns "myobject"
 
       @searcher.search(@request).should == 'myobject'
     end
 
     it "should use the URI generated by the Handler module" do
       @searcher.expects(:indirection2uri).with(@request).returns "/mys/uri"
       @connection.expects(:get).with { |path, args| path == "/mys/uri" }.returns(@response)
       @searcher.search(@request)
     end
 
     it "should provide an Accept header containing the list of supported formats joined with commas" do
       @connection.expects(:get).with { |path, args| args["Accept"] == "supported, formats" }.returns(@response)
 
       @searcher.model.expects(:supported_formats).returns %w{supported formats}
       @searcher.search(@request)
     end
 
     it "should return an empty array if serialization returns nil" do
       @model.stubs(:convert_from_multiple).returns nil
 
       @searcher.search(@request).should == []
     end
 
     it "should generate an error when result data deserializes fails" do
       @searcher.expects(:deserialize).raises(ArgumentError)
       lambda { @searcher.search(@request) }.should raise_error(ArgumentError)
     end
   end
 
   describe "when doing a destroy" do
     before :each do
       @connection = stub('mock http connection', :delete => @response, :verify_callback= => nil)
       @searcher.stubs(:network).returns(@connection)    # neuter the network connection
 
       @request = Puppet::Indirector::Request.new(:foo, :destroy, "foo bar")
     end
 
     it "should call the DELETE http method on a network connection" do
       @searcher.expects(:network).returns @connection
       @connection.expects(:delete).returns @response
       @searcher.destroy(@request)
     end
 
     it "should fail if any options are provided, since DELETE apparently does not support query options" do
       @request.stubs(:options).returns(:one => "two", :three => "four")
 
       lambda { @searcher.destroy(@request) }.should raise_error(ArgumentError)
     end
 
     it "should deserialize and return the http response" do
       @connection.expects(:delete).returns @response
       @searcher.expects(:deserialize).with(@response).returns "myobject"
 
       @searcher.destroy(@request).should == 'myobject'
     end
 
     it "should use the URI generated by the Handler module" do
       @searcher.expects(:indirection2uri).with(@request).returns "/my/uri"
       @connection.expects(:delete).with { |path, args| path == "/my/uri" }.returns(@response)
       @searcher.destroy(@request)
     end
 
     it "should not include the query string" do
       @connection.stubs(:delete).returns @response
       @searcher.destroy(@request)
     end
 
     it "should provide an Accept header containing the list of supported formats joined with commas" do
       @connection.expects(:delete).with { |path, args| args["Accept"] == "supported, formats" }.returns(@response)
 
       @searcher.model.expects(:supported_formats).returns %w{supported formats}
       @searcher.destroy(@request)
     end
 
     it "should deserialize and return the network response" do
       @searcher.expects(:deserialize).with(@response).returns @instance
       @searcher.destroy(@request).should equal(@instance)
     end
 
     it "should generate an error when result data deserializes fails" do
       @searcher.expects(:deserialize).raises(ArgumentError)
       lambda { @searcher.destroy(@request) }.should raise_error(ArgumentError)
     end
   end
 
   describe "when doing a save" do
     before :each do
       @connection = stub('mock http connection', :put => @response, :verify_callback= => nil)
       @searcher.stubs(:network).returns(@connection)    # neuter the network connection
 
       @instance = stub 'instance', :render => "mydata", :mime => "mime"
       @request = Puppet::Indirector::Request.new(:foo, :save, "foo bar")
       @request.instance = @instance
     end
 
     it "should call the PUT http method on a network connection" do
       @searcher.expects(:network).returns @connection
       @connection.expects(:put).returns @response
       @searcher.save(@request)
     end
 
     it "should fail if any options are provided, since DELETE apparently does not support query options" do
       @request.stubs(:options).returns(:one => "two", :three => "four")
 
       lambda { @searcher.save(@request) }.should raise_error(ArgumentError)
     end
 
     it "should use the URI generated by the Handler module" do
       @searcher.expects(:indirection2uri).with(@request).returns "/my/uri"
       @connection.expects(:put).with { |path, args| path == "/my/uri" }.returns(@response)
       @searcher.save(@request)
     end
 
     it "should serialize the instance using the default format and pass the result as the body of the request" do
       @instance.expects(:render).returns "serial_instance"
       @connection.expects(:put).with { |path, data, args| data == "serial_instance" }.returns @response
 
       @searcher.save(@request)
     end
 
     it "should deserialize and return the http response" do
       @connection.expects(:put).returns @response
       @searcher.expects(:deserialize).with(@response).returns "myobject"
 
       @searcher.save(@request).should == 'myobject'
     end
 
     it "should provide an Accept header containing the list of supported formats joined with commas" do
       @connection.expects(:put).with { |path, data, args| args["Accept"] == "supported, formats" }.returns(@response)
 
       @searcher.model.expects(:supported_formats).returns %w{supported formats}
       @searcher.save(@request)
     end
 
     it "should provide a Content-Type header containing the mime-type of the sent object" do
       @connection.expects(:put).with { |path, data, args| args['Content-Type'] == "mime" }.returns(@response)
 
       @instance.expects(:mime).returns "mime"
       @searcher.save(@request)
     end
 
     it "should deserialize and return the network response" do
       @searcher.expects(:deserialize).with(@response).returns @instance
       @searcher.save(@request).should equal(@instance)
     end
 
     it "should generate an error when result data deserializes fails" do
       @searcher.expects(:deserialize).raises(ArgumentError)
       lambda { @searcher.save(@request) }.should raise_error(ArgumentError)
     end
   end
 end
diff --git a/spec/unit/network/handler/ca_spec.rb b/spec/unit/network/handler/ca_spec.rb
index d61360e20..2717b4bb2 100644
--- a/spec/unit/network/handler/ca_spec.rb
+++ b/spec/unit/network/handler/ca_spec.rb
@@ -1,86 +1,86 @@
 require 'spec_helper'
 
 require 'puppet/network/handler/ca'
 
 describe Puppet::Network::Handler::CA do
   include PuppetSpec::Files
 
   describe "#getcert" do
     let(:host)      { "testhost" }
     let(:x509_name) { OpenSSL::X509::Name.new [['CN', host]] }
     let(:key)       { Puppet::SSL::Key.new(host).generate }
 
     let(:csr) do
       csr = OpenSSL::X509::Request.new
       csr.subject = x509_name
       csr.public_key = key.public_key
       csr
     end
 
     let(:ca)     { Puppet::SSL::CertificateAuthority.new }
     let(:cacert) { ca.instance_variable_get(:@certificate) }
 
     before :each do
       Puppet[:confdir] = tmpdir('conf')
 
       Puppet::SSL::CertificateAuthority.stubs(:ca?).returns true
       Puppet::SSL::CertificateAuthority.stubs(:singleton_instance).returns ca
     end
 
     it "should do nothing if the master is not a CA" do
       Puppet::SSL::CertificateAuthority.stubs(:ca?).returns false
 
       csr = OpenSSL::X509::Request.new
       subject.getcert(csr.to_pem).should == ''
     end
 
     describe "when a certificate already exists for the host" do
       let!(:cert)    { ca.generate(host) }
 
       it "should return the existing cert if it matches the public key of the CSR" do
         csr.public_key = cert.content.public_key
 
         subject.getcert(csr.to_pem).should == [cert.to_s, cacert.to_s]
       end
 
       it "should fail if the public key of the CSR does not match the existing cert" do
         expect do
           subject.getcert(csr.to_pem)
         end.to raise_error(Puppet::Error, /Certificate request does not match existing certificate/)
       end
     end
 
     describe "when autosign is enabled" do
       before :each do
         Puppet[:autosign] = true
       end
 
       it "should return the new cert and the CA cert" do
         cert_str, cacert_str = subject.getcert(csr.to_pem)
 
         returned_cert = Puppet::SSL::Certificate.from_s(cert_str)
         returned_cacert = Puppet::SSL::Certificate.from_s(cacert_str)
 
         returned_cert.name.should == host
         returned_cacert.content.subject.cmp(cacert.content.subject).should == 0
       end
     end
 
     describe "when autosign is disabled" do
       before :each do
         Puppet[:autosign] = false
       end
 
       it "should save the CSR without signing it" do
         subject.getcert(csr.to_pem)
 
-        Puppet::SSL::Certificate.find(host).should be_nil
-        Puppet::SSL::CertificateRequest.find(host).should be_a(Puppet::SSL::CertificateRequest)
+        Puppet::SSL::Certificate.indirection.find(host).should be_nil
+        Puppet::SSL::CertificateRequest.indirection.find(host).should be_a(Puppet::SSL::CertificateRequest)
       end
 
       it "should not return a cert" do
         subject.getcert(csr.to_pem).should be_nil
       end
     end
   end
 end
diff --git a/spec/unit/ssl/certificate_authority_spec.rb b/spec/unit/ssl/certificate_authority_spec.rb
index 603e10296..1e67fa1af 100755
--- a/spec/unit/ssl/certificate_authority_spec.rb
+++ b/spec/unit/ssl/certificate_authority_spec.rb
@@ -1,882 +1,882 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'puppet/ssl/certificate_authority'
 
 describe Puppet::SSL::CertificateAuthority do
   after do
     Puppet::SSL::CertificateAuthority.instance_variable_set(:@singleton_instance, nil)
     Puppet.settings.clearused
   end
 
   def stub_ca_host
     @key = mock 'key'
     @key.stubs(:content).returns "cakey"
     @cacert = mock 'certificate'
     @cacert.stubs(:content).returns "cacertificate"
 
     @host = stub 'ssl_host', :key => @key, :certificate => @cacert, :name => Puppet::SSL::Host.ca_name
   end
 
   it "should have a class method for returning a singleton instance" do
     Puppet::SSL::CertificateAuthority.should respond_to(:instance)
   end
 
   describe "when finding an existing instance" do
     describe "and the host is a CA host and the run_mode is master" do
       before do
         Puppet[:ca] = true
         Puppet.run_mode.stubs(:master?).returns true
 
         @ca = mock('ca')
         Puppet::SSL::CertificateAuthority.stubs(:new).returns @ca
       end
 
       it "should return an instance" do
         Puppet::SSL::CertificateAuthority.instance.should equal(@ca)
       end
 
       it "should always return the same instance" do
         Puppet::SSL::CertificateAuthority.instance.should equal(Puppet::SSL::CertificateAuthority.instance)
       end
     end
 
     describe "and the host is not a CA host" do
       it "should return nil" do
         Puppet.settings.stubs(:value).with(:ca).returns false
         Puppet.run_mode.stubs(:master?).returns true
 
         ca = mock('ca')
         Puppet::SSL::CertificateAuthority.expects(:new).never
         Puppet::SSL::CertificateAuthority.instance.should be_nil
       end
     end
 
     describe "and the run_mode is not master" do
       it "should return nil" do
         Puppet.settings.stubs(:value).with(:ca).returns true
         Puppet.run_mode.stubs(:master?).returns false
 
         ca = mock('ca')
         Puppet::SSL::CertificateAuthority.expects(:new).never
         Puppet::SSL::CertificateAuthority.instance.should be_nil
       end
     end
   end
 
   describe "when initializing" do
     before do
       Puppet.settings.stubs(:use)
       Puppet.settings.stubs(:value).returns "ca_testing"
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:setup)
     end
 
     it "should always set its name to the value of :certname" do
       Puppet.settings.expects(:value).with(:certname).returns "ca_testing"
 
       Puppet::SSL::CertificateAuthority.new.name.should == "ca_testing"
     end
 
     it "should create an SSL::Host instance whose name is the 'ca_name'" do
       Puppet::SSL::Host.expects(:ca_name).returns "caname"
 
       host = stub 'host'
       Puppet::SSL::Host.expects(:new).with("caname").returns host
 
       Puppet::SSL::CertificateAuthority.new
     end
 
     it "should use the :main, :ca, and :ssl settings sections" do
       Puppet.settings.expects(:use).with(:main, :ssl, :ca)
       Puppet::SSL::CertificateAuthority.new
     end
 
     it "should create an inventory instance" do
       Puppet::SSL::Inventory.expects(:new).returns "inventory"
 
       Puppet::SSL::CertificateAuthority.new.inventory.should == "inventory"
     end
 
     it "should make sure the CA is set up" do
       Puppet::SSL::CertificateAuthority.any_instance.expects(:setup)
 
       Puppet::SSL::CertificateAuthority.new
     end
   end
 
   describe "when setting itself up" do
     it "should generate the CA certificate if it does not have one" do
       Puppet.settings.stubs :use
 
       host = stub 'host'
       Puppet::SSL::Host.stubs(:new).returns host
 
       host.expects(:certificate).returns nil
 
       Puppet::SSL::CertificateAuthority.any_instance.expects(:generate_ca_certificate)
       Puppet::SSL::CertificateAuthority.new
     end
   end
 
   describe "when retrieving the certificate revocation list" do
     before do
       Puppet.settings.stubs(:use)
       Puppet.settings.stubs(:value).returns "ca_testing"
       Puppet.settings.stubs(:value).with(:cacrl).returns "/my/crl"
 
       cert = stub("certificate", :content => "real_cert")
       key = stub("key", :content => "real_key")
       @host = stub 'host', :certificate => cert, :name => "hostname", :key => key
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:setup)
       @ca = Puppet::SSL::CertificateAuthority.new
 
       @ca.stubs(:host).returns @host
     end
 
     it "should return any found CRL instance" do
       crl = mock 'crl'
       Puppet::SSL::CertificateRevocationList.indirection.expects(:find).returns crl
       @ca.crl.should equal(crl)
     end
 
     it "should create, generate, and save a new CRL instance of no CRL can be found" do
       crl = Puppet::SSL::CertificateRevocationList.new("fakename")
       Puppet::SSL::CertificateRevocationList.indirection.expects(:find).returns nil
 
       Puppet::SSL::CertificateRevocationList.expects(:new).returns crl
 
       crl.expects(:generate).with(@ca.host.certificate.content, @ca.host.key.content)
       Puppet::SSL::CertificateRevocationList.indirection.expects(:save).with(crl)
 
       @ca.crl.should equal(crl)
     end
   end
 
   describe "when generating a self-signed CA certificate" do
     before do
       Puppet.settings.stubs(:use)
       Puppet.settings.stubs(:value).returns "ca_testing"
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:setup)
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:crl)
       @ca = Puppet::SSL::CertificateAuthority.new
 
       @host = stub 'host', :key => mock("key"), :name => "hostname", :certificate => mock('certificate')
 
       Puppet::SSL::CertificateRequest.any_instance.stubs(:generate)
 
       @ca.stubs(:host).returns @host
     end
 
     it "should create and store a password at :capass" do
       Puppet.settings.expects(:value).with(:capass).returns "/path/to/pass"
 
       FileTest.expects(:exist?).with("/path/to/pass").returns false
 
       fh = mock 'filehandle'
       Puppet.settings.expects(:write).with(:capass).yields fh
 
       fh.expects(:print).with { |s| s.length > 18 }
 
       @ca.stubs(:sign)
 
       @ca.generate_ca_certificate
     end
 
     it "should generate a key if one does not exist" do
       @ca.stubs :generate_password
       @ca.stubs :sign
 
       @ca.host.expects(:key).returns nil
       @ca.host.expects(:generate_key)
 
       @ca.generate_ca_certificate
     end
 
     it "should create and sign a self-signed cert using the CA name" do
       request = mock 'request'
       Puppet::SSL::CertificateRequest.expects(:new).with(@ca.host.name).returns request
       request.expects(:generate).with(@ca.host.key)
       request.stubs(:request_extensions => [])
 
       @ca.expects(:sign).with(@host.name, false, request)
 
       @ca.stubs :generate_password
 
       @ca.generate_ca_certificate
     end
 
     it "should generate its CRL" do
       @ca.stubs :generate_password
       @ca.stubs :sign
 
       @ca.host.expects(:key).returns nil
       @ca.host.expects(:generate_key)
 
       @ca.expects(:crl)
 
       @ca.generate_ca_certificate
     end
   end
 
   describe "when signing" do
     before do
       Puppet.settings.stubs(:use)
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:password?).returns true
 
       stub_ca_host
 
       Puppet::SSL::Host.expects(:new).with(Puppet::SSL::Host.ca_name).returns @host
 
       @ca = Puppet::SSL::CertificateAuthority.new
 
       @name = "myhost"
       @real_cert = stub 'realcert', :sign => nil
       @cert = Puppet::SSL::Certificate.new(@name)
       @cert.content = @real_cert
 
       Puppet::SSL::Certificate.stubs(:new).returns @cert
 
       @cert.stubs(:content=)
       Puppet::SSL::Certificate.indirection.stubs(:save)
 
       # Stub out the factory
       Puppet::SSL::CertificateFactory.stubs(:build).returns "my real cert"
 
       @request_content = stub "request content stub", :subject => @name
       @request = stub 'request', :name => @name, :request_extensions => [], :subject_alt_names => [], :content => @request_content
 
       # And the inventory
       @inventory = stub 'inventory', :add => nil
       @ca.stubs(:inventory).returns @inventory
 
       Puppet::SSL::CertificateRequest.indirection.stubs(:destroy)
     end
 
     describe "and calculating the next certificate serial number" do
       before do
         @path = "/path/to/serial"
         Puppet.settings.stubs(:value).with(:serial).returns @path
 
         @filehandle = stub 'filehandle', :<< => @filehandle
         Puppet.settings.stubs(:readwritelock).with(:serial).yields @filehandle
       end
 
       it "should default to 0x1 for the first serial number" do
         @ca.next_serial.should == 0x1
       end
 
       it "should return the current content of the serial file" do
         FileTest.stubs(:exist?).with(@path).returns true
         File.expects(:read).with(@path).returns "0002"
 
         @ca.next_serial.should == 2
       end
 
       it "should write the next serial number to the serial file as hex" do
         @filehandle.expects(:<<).with("0002")
 
         @ca.next_serial
       end
 
       it "should lock the serial file while writing" do
         Puppet.settings.expects(:readwritelock).with(:serial)
 
         @ca.next_serial
       end
     end
 
     describe "its own certificate" do
       before do
         @serial = 10
         @ca.stubs(:next_serial).returns @serial
       end
 
       it "should not look up a certificate request for the host" do
         Puppet::SSL::CertificateRequest.indirection.expects(:find).never
 
         @ca.sign(@name, true, @request)
       end
 
       it "should use a certificate type of :ca" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[0] == :ca
         end.returns "my real cert"
         @ca.sign(@name, :ca, @request)
       end
 
       it "should pass the provided CSR as the CSR" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[1] == @request
         end.returns "my real cert"
         @ca.sign(@name, :ca, @request)
       end
 
       it "should use the provided CSR's content as the issuer" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[2].subject == "myhost"
         end.returns "my real cert"
         @ca.sign(@name, :ca, @request)
       end
 
       it "should pass the next serial as the serial number" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[3] == @serial
         end.returns "my real cert"
         @ca.sign(@name, :ca, @request)
       end
 
       it "should sign the certificate request even if it contains alt names" do
         @request.stubs(:subject_alt_names).returns %w[DNS:foo DNS:bar DNS:baz]
 
         expect do
           @ca.sign(@name, false, @request)
         end.should_not raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError)
       end
 
       it "should save the resulting certificate" do
         Puppet::SSL::Certificate.indirection.expects(:save).with(@cert)
 
         @ca.sign(@name, :ca, @request)
       end
     end
 
     describe "another host's certificate" do
       before do
         @serial = 10
         @ca.stubs(:next_serial).returns @serial
 
         Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
         Puppet::SSL::CertificateRequest.indirection.stubs :save
       end
 
       it "should use a certificate type of :server" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[0] == :server
         end.returns "my real cert"
 
         @ca.sign(@name)
       end
 
       it "should use look up a CSR for the host in the :ca_file terminus" do
         Puppet::SSL::CertificateRequest.indirection.expects(:find).with(@name).returns @request
 
         @ca.sign(@name)
       end
 
       it "should fail if no CSR can be found for the host" do
         Puppet::SSL::CertificateRequest.indirection.expects(:find).with(@name).returns nil
 
         lambda { @ca.sign(@name) }.should raise_error(ArgumentError)
       end
 
       it "should fail if an unknown request extension is present" do
         @request.stubs :request_extensions => [{ "oid"   => "bananas",
                                                  "value" => "delicious" }]
         expect { @ca.sign(@name) }.
           should raise_error(/CSR has request extensions that are not permitted/)
       end
 
       it "should fail if the CSR contains alt names and they are not expected" do
         @request.stubs(:subject_alt_names).returns %w[DNS:foo DNS:bar DNS:baz]
 
         expect do
           @ca.sign(@name, false)
         end.to raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError, /CSR contained subject alternative names/)
       end
 
       it "should not fail if the CSR does not contain alt names and they are expected" do
         @request.stubs(:subject_alt_names).returns []
         expect { @ca.sign(@name, true) }.should_not raise_error
       end
 
       it "should reject alt names by default" do
         @request.stubs(:subject_alt_names).returns %w[DNS:foo DNS:bar DNS:baz]
 
         expect do
           @ca.sign(@name)
         end.to raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError, /CSR contained subject alternative names/)
       end
 
       it "should use the CA certificate as the issuer" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[2] == @cacert.content
         end.returns "my real cert"
         @ca.sign(@name)
       end
 
       it "should pass the next serial as the serial number" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[3] == @serial
         end.returns "my real cert"
         @ca.sign(@name)
       end
 
       it "should sign the resulting certificate using its real key and a digest" do
         digest = mock 'digest'
         OpenSSL::Digest::SHA1.expects(:new).returns digest
 
         key = stub 'key', :content => "real_key"
         @ca.host.stubs(:key).returns key
 
         @cert.content.expects(:sign).with("real_key", digest)
         @ca.sign(@name)
       end
 
       it "should save the resulting certificate" do
         Puppet::SSL::Certificate.indirection.stubs(:save).with(@cert)
         @ca.sign(@name)
       end
 
       it "should remove the host's certificate request" do
         Puppet::SSL::CertificateRequest.indirection.expects(:destroy).with(@name)
 
         @ca.sign(@name)
       end
 
       it "should check the internal signing policies" do
         @ca.expects(:check_internal_signing_policies).returns true
         @ca.sign(@name)
       end
     end
 
     context "#check_internal_signing_policies" do
       before do
         @serial = 10
         @ca.stubs(:next_serial).returns @serial
 
-        Puppet::SSL::CertificateRequest.stubs(:find).with(@name).returns @request
+        Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
         @cert.stubs :save
       end
 
       it "should reject a critical extension that isn't on the whitelist" do
         @request.stubs(:request_extensions).returns [{ "oid" => "banana",
                                                        "value" => "yumm",
                                                        "critical" => true }]
         expect { @ca.sign(@name) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /request extensions that are not permitted/
         )
       end
 
       it "should reject a non-critical extension that isn't on the whitelist" do
         @request.stubs(:request_extensions).returns [{ "oid" => "peach",
                                                        "value" => "meh",
                                                        "critical" => false }]
         expect { @ca.sign(@name) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /request extensions that are not permitted/
         )
       end
 
       it "should reject non-whitelist extensions even if a valid extension is present" do
         @request.stubs(:request_extensions).returns [{ "oid" => "peach",
                                                        "value" => "meh",
                                                        "critical" => false },
                                                      { "oid" => "subjectAltName",
                                                        "value" => "DNS:foo",
                                                        "critical" => true }]
         expect { @ca.sign(@name) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /request extensions that are not permitted/
         )
       end
 
       it "should reject a subjectAltName for a non-DNS value" do
         @request.stubs(:subject_alt_names).returns ['DNS:foo', 'email:bar@example.com']
         expect { @ca.sign(@name, true) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /subjectAltName outside the DNS label space/
         )
       end
 
       it "should reject a wildcard subject" do
         @request.content.stubs(:subject).
           returns(OpenSSL::X509::Name.new([["CN", "*.local"]]))
 
         expect { @ca.sign(@name) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /subject contains a wildcard/
         )
       end
 
       it "should reject a wildcard subjectAltName" do
         @request.stubs(:subject_alt_names).returns ['DNS:foo', 'DNS:*.bar']
         expect { @ca.sign(@name, true) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /subjectAltName contains a wildcard/
         )
       end
     end
 
     it "should create a certificate instance with the content set to the newly signed x509 certificate" do
       @serial = 10
       @ca.stubs(:next_serial).returns @serial
 
       Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
       Puppet::SSL::Certificate.indirection.stubs :save
       Puppet::SSL::Certificate.expects(:new).with(@name).returns @cert
 
       @ca.sign(@name)
     end
 
     it "should return the certificate instance" do
       @ca.stubs(:next_serial).returns @serial
       Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
       Puppet::SSL::Certificate.indirection.stubs :save
       @ca.sign(@name).should equal(@cert)
     end
 
     it "should add the certificate to its inventory" do
       @ca.stubs(:next_serial).returns @serial
       @inventory.expects(:add).with(@cert)
 
       Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
       Puppet::SSL::Certificate.indirection.stubs :save
       @ca.sign(@name)
     end
 
     it "should have a method for triggering autosigning of available CSRs" do
       @ca.should respond_to(:autosign)
     end
 
     describe "when autosigning certificates" do
       it "should do nothing if autosign is disabled" do
         Puppet.settings.expects(:value).with(:autosign).returns 'false'
 
         Puppet::SSL::CertificateRequest.indirection.expects(:search).never
         @ca.autosign
       end
 
       it "should do nothing if no autosign.conf exists" do
         Puppet.settings.expects(:value).with(:autosign).returns '/auto/sign'
         FileTest.expects(:exist?).with("/auto/sign").returns false
 
         Puppet::SSL::CertificateRequest.indirection.expects(:search).never
         @ca.autosign
       end
 
       describe "and autosign is enabled and the autosign.conf file exists" do
         before do
           Puppet.settings.stubs(:value).with(:autosign).returns '/auto/sign'
           FileTest.stubs(:exist?).with("/auto/sign").returns true
           File.stubs(:readlines).with("/auto/sign").returns ["one\n", "two\n"]
 
           Puppet::SSL::CertificateRequest.indirection.stubs(:search).returns []
 
           @store = stub 'store', :allow => nil
           Puppet::Network::AuthStore.stubs(:new).returns @store
         end
 
         describe "when creating the AuthStore instance to verify autosigning" do
           it "should create an AuthStore with each line in the configuration file allowed to be autosigned" do
             Puppet::Network::AuthStore.expects(:new).returns @store
 
             @store.expects(:allow).with("one")
             @store.expects(:allow).with("two")
 
             @ca.autosign
           end
 
           it "should reparse the autosign configuration on each call" do
             Puppet::Network::AuthStore.expects(:new).times(2).returns @store
 
             @ca.autosign
             @ca.autosign
           end
 
           it "should ignore comments" do
             File.stubs(:readlines).with("/auto/sign").returns ["one\n", "#two\n"]
 
             @store.expects(:allow).with("one")
             @ca.autosign
           end
 
           it "should ignore blank lines" do
             File.stubs(:readlines).with("/auto/sign").returns ["one\n", "\n"]
 
             @store.expects(:allow).with("one")
             @ca.autosign
           end
         end
 
         it "should sign all CSRs whose hostname matches the autosign configuration" do
           csr1 = mock 'csr1'
           csr2 = mock 'csr2'
           Puppet::SSL::CertificateRequest.indirection.stubs(:search).returns [csr1, csr2]
         end
 
         it "should not sign CSRs whose hostname does not match the autosign configuration" do
           csr1 = mock 'csr1'
           csr2 = mock 'csr2'
           Puppet::SSL::CertificateRequest.indirection.stubs(:search).returns [csr1, csr2]
         end
       end
     end
   end
 
   describe "when managing certificate clients" do
     before do
       Puppet.settings.stubs(:use)
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:password?).returns true
 
       stub_ca_host
 
       Puppet::SSL::Host.expects(:new).returns @host
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:host).returns @host
 
       @cacert = mock 'certificate'
       @cacert.stubs(:content).returns "cacertificate"
       @ca = Puppet::SSL::CertificateAuthority.new
     end
 
     it "should have a method for acting on the SSL files" do
       @ca.should respond_to(:apply)
     end
 
     describe "when applying a method to a set of hosts" do
       it "should fail if no subjects have been specified" do
         lambda { @ca.apply(:generate) }.should raise_error(ArgumentError)
       end
 
       it "should create an Interface instance with the specified method and the options" do
         Puppet::SSL::CertificateAuthority::Interface.expects(:new).with(:generate, :to => :host).returns(stub('applier', :apply => nil))
         @ca.apply(:generate, :to => :host)
       end
 
       it "should apply the Interface with itself as the argument" do
         applier = stub('applier')
         applier.expects(:apply).with(@ca)
         Puppet::SSL::CertificateAuthority::Interface.expects(:new).returns applier
         @ca.apply(:generate, :to => :ca_testing)
       end
     end
 
     it "should be able to list waiting certificate requests" do
       req1 = stub 'req1', :name => "one"
       req2 = stub 'req2', :name => "two"
       Puppet::SSL::CertificateRequest.indirection.expects(:search).with("*").returns [req1, req2]
 
       @ca.waiting?.should == %w{one two}
     end
 
     it "should delegate removing hosts to the Host class" do
       Puppet::SSL::Host.expects(:destroy).with("myhost")
 
       @ca.destroy("myhost")
     end
 
     it "should be able to verify certificates" do
       @ca.should respond_to(:verify)
     end
 
     it "should list certificates as the sorted list of all existing signed certificates" do
       cert1 = stub 'cert1', :name => "cert1"
       cert2 = stub 'cert2', :name => "cert2"
       Puppet::SSL::Certificate.indirection.expects(:search).with("*").returns [cert1, cert2]
       @ca.list.should == %w{cert1 cert2}
     end
 
     describe "and printing certificates" do
       it "should return nil if the certificate cannot be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns nil
         @ca.print("myhost").should be_nil
       end
 
       it "should print certificates by calling :to_text on the host's certificate" do
         cert1 = stub 'cert1', :name => "cert1", :to_text => "mytext"
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns cert1
         @ca.print("myhost").should == "mytext"
       end
     end
 
     describe "and fingerprinting certificates" do
       before :each do
         @cert = stub 'cert', :name => "cert", :fingerprint => "DIGEST"
         Puppet::SSL::Certificate.indirection.stubs(:find).with("myhost").returns @cert
         Puppet::SSL::CertificateRequest.indirection.stubs(:find).with("myhost")
       end
 
       it "should raise an error if the certificate or CSR cannot be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns nil
         Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myhost").returns nil
         lambda { @ca.fingerprint("myhost") }.should raise_error
       end
 
       it "should try to find a CSR if no certificate can be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns nil
         Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myhost").returns @cert
         @cert.expects(:fingerprint)
         @ca.fingerprint("myhost")
       end
 
       it "should delegate to the certificate fingerprinting" do
         @cert.expects(:fingerprint)
         @ca.fingerprint("myhost")
       end
 
       it "should propagate the digest algorithm to the certificate fingerprinting system" do
         @cert.expects(:fingerprint).with(:digest)
         @ca.fingerprint("myhost", :digest)
       end
     end
 
     describe "and verifying certificates" do
       before do
         @store = stub 'store', :verify => true, :add_file => nil, :purpose= => nil, :add_crl => true, :flags= => nil
 
         OpenSSL::X509::Store.stubs(:new).returns @store
 
         Puppet.settings.stubs(:value).returns "crtstuff"
 
         @cert = stub 'cert', :content => "mycert"
         Puppet::SSL::Certificate.indirection.stubs(:find).returns @cert
 
         @crl = stub('crl', :content => "mycrl")
 
         @ca.stubs(:crl).returns @crl
       end
 
       it "should fail if the host's certificate cannot be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("me").returns(nil)
 
         lambda { @ca.verify("me") }.should raise_error(ArgumentError)
       end
 
       it "should create an SSL Store to verify" do
         OpenSSL::X509::Store.expects(:new).returns @store
 
         @ca.verify("me")
       end
 
       it "should add the CA Certificate to the store" do
         Puppet.settings.stubs(:value).with(:cacert).returns "/ca/cert"
         @store.expects(:add_file).with "/ca/cert"
 
         @ca.verify("me")
       end
 
       it "should add the CRL to the store if the crl is enabled" do
         @store.expects(:add_crl).with "mycrl"
 
         @ca.verify("me")
       end
 
       it "should set the store purpose to OpenSSL::X509::PURPOSE_SSL_CLIENT" do
         Puppet.settings.stubs(:value).with(:cacert).returns "/ca/cert"
         @store.expects(:add_file).with "/ca/cert"
 
         @ca.verify("me")
       end
 
       it "should set the store flags to check the crl" do
         @store.expects(:flags=).with OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK
 
         @ca.verify("me")
       end
 
       it "should use the store to verify the certificate" do
         @cert.expects(:content).returns "mycert"
 
         @store.expects(:verify).with("mycert").returns true
 
         @ca.verify("me")
       end
 
       it "should fail if the verification returns false" do
         @cert.expects(:content).returns "mycert"
 
         @store.expects(:verify).with("mycert").returns false
 
         lambda { @ca.verify("me") }.should raise_error
       end
     end
 
     describe "and revoking certificates" do
       before do
         @crl = mock 'crl'
         @ca.stubs(:crl).returns @crl
 
         @ca.stubs(:next_serial).returns 10
 
         @real_cert = stub 'real_cert', :serial => 15
         @cert = stub 'cert', :content => @real_cert
         Puppet::SSL::Certificate.indirection.stubs(:find).returns @cert
 
       end
 
       it "should fail if the certificate revocation list is disabled" do
         @ca.stubs(:crl).returns false
 
         lambda { @ca.revoke('ca_testing') }.should raise_error(ArgumentError)
 
       end
 
       it "should delegate the revocation to its CRL" do
         @ca.crl.expects(:revoke)
 
         @ca.revoke('host')
       end
 
       it "should get the serial number from the local certificate if it exists" do
         @ca.crl.expects(:revoke).with { |serial, key| serial == 15 }
 
         Puppet::SSL::Certificate.indirection.expects(:find).with("host").returns @cert
 
         @ca.revoke('host')
       end
 
       it "should get the serial number from inventory if no local certificate exists" do
         real_cert = stub 'real_cert', :serial => 15
         cert = stub 'cert', :content => real_cert
         Puppet::SSL::Certificate.indirection.expects(:find).with("host").returns nil
 
         @ca.inventory.expects(:serial).with("host").returns 16
 
         @ca.crl.expects(:revoke).with { |serial, key| serial == 16 }
         @ca.revoke('host')
       end
     end
 
     it "should be able to generate a complete new SSL host" do
       @ca.should respond_to(:generate)
     end
 
     describe "and generating certificates" do
       before do
         @host = stub 'host', :generate_certificate_request => nil
         Puppet::SSL::Host.stubs(:new).returns @host
         Puppet::SSL::Certificate.indirection.stubs(:find).returns nil
 
         @ca.stubs(:sign)
       end
 
       it "should fail if a certificate already exists for the host" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("him").returns "something"
 
         lambda { @ca.generate("him") }.should raise_error(ArgumentError)
       end
 
       it "should create a new Host instance with the correct name" do
         Puppet::SSL::Host.expects(:new).with("him").returns @host
 
         @ca.generate("him")
       end
 
       it "should use the Host to generate the certificate request" do
         @host.expects :generate_certificate_request
 
         @ca.generate("him")
       end
 
       it "should sign the generated request" do
         @ca.expects(:sign).with("him", false)
         @ca.generate("him")
       end
     end
   end
 end
diff --git a/spec/unit/ssl/host_spec.rb b/spec/unit/ssl/host_spec.rb
index 5d6ceda37..61c8c133d 100755
--- a/spec/unit/ssl/host_spec.rb
+++ b/spec/unit/ssl/host_spec.rb
@@ -1,825 +1,824 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'puppet/ssl/host'
-require 'puppet/sslcertificates'
-require 'puppet/sslcertificates/ca'
 
 # REMIND: Fails on windows because there is no user provider yet
 describe Puppet::SSL::Host, :fails_on_windows => true do
   include PuppetSpec::Files
 
   before do
     Puppet::SSL::Host.indirection.terminus_class = :file
 
     # Get a safe temporary file
     dir = tmpdir("ssl_host_testing")
     Puppet.settings[:confdir] = dir
     Puppet.settings[:vardir] = dir
     Puppet.settings.use :main, :ssl
 
     @host = Puppet::SSL::Host.new("myname")
   end
 
   after do
     # Cleaned out any cached localhost instance.
     Puppet::SSL::Host.reset
     Puppet::SSL::Host.ca_location = :none
   end
 
   it "should use any provided name as its name" do
     @host.name.should == "myname"
   end
 
   it "should retrieve its public key from its private key" do
     realkey = mock 'realkey'
     key = stub 'key', :content => realkey
     Puppet::SSL::Key.indirection.stubs(:find).returns(key)
     pubkey = mock 'public_key'
     realkey.expects(:public_key).returns pubkey
 
     @host.public_key.should equal(pubkey)
   end
 
   it "should default to being a non-ca host" do
     @host.ca?.should be_false
   end
 
   it "should be a ca host if its name matches the CA_NAME" do
     Puppet::SSL::Host.stubs(:ca_name).returns "yayca"
     Puppet::SSL::Host.new("yayca").should be_ca
   end
 
   it "should have a method for determining the CA location" do
     Puppet::SSL::Host.should respond_to(:ca_location)
   end
 
   it "should have a method for specifying the CA location" do
     Puppet::SSL::Host.should respond_to(:ca_location=)
   end
 
   it "should have a method for retrieving the default ssl host" do
     Puppet::SSL::Host.should respond_to(:ca_location=)
   end
 
   it "should have a method for producing an instance to manage the local host's keys" do
     Puppet::SSL::Host.should respond_to(:localhost)
   end
 
   it "should allow to reset localhost" do
     previous_host = Puppet::SSL::Host.localhost
     Puppet::SSL::Host.reset
     Puppet::SSL::Host.localhost.should_not == previous_host
   end
 
   it "should generate the certificate for the localhost instance if no certificate is available" do
     host = stub 'host', :key => nil
     Puppet::SSL::Host.expects(:new).returns host
 
     host.expects(:certificate).returns nil
     host.expects(:generate)
 
     Puppet::SSL::Host.localhost.should equal(host)
   end
 
   context "with dns_alt_names" do
     before :each do
       Puppet[:dns_alt_names] = 'one, two'
 
       @key = stub('key content')
-      key = stub('key', :generate => true, :save => true, :content => @key)
+      key = stub('key', :generate => true, :content => @key)
       Puppet::SSL::Key.stubs(:new).returns key
+      Puppet::SSL::Key.indirection.stubs(:save).with(key)
 
-      @cr = stub('certificate request', :save => true)
+      @cr = stub('certificate request')
       Puppet::SSL::CertificateRequest.stubs(:new).returns @cr
+      Puppet::SSL::CertificateRequest.indirection.stubs(:save).with(@cr)
     end
 
     it "should not include subjectAltName if not the local node" do
       @cr.expects(:generate).with(@key, {})
 
       Puppet::SSL::Host.new('not-the-' + Puppet[:certname]).generate
     end
 
     it "should include subjectAltName if I am a CA" do
       @cr.expects(:generate).
         with(@key, { :dns_alt_names => Puppet[:dns_alt_names] })
 
       Puppet::SSL::Host.localhost
     end
   end
 
   it "should always read the key for the localhost instance in from disk" do
     host = stub 'host', :certificate => "eh"
     Puppet::SSL::Host.expects(:new).returns host
 
     host.expects(:key)
 
     Puppet::SSL::Host.localhost
   end
 
   it "should cache the localhost instance" do
     host = stub 'host', :certificate => "eh", :key => 'foo'
     Puppet::SSL::Host.expects(:new).once.returns host
 
     Puppet::SSL::Host.localhost.should == Puppet::SSL::Host.localhost
   end
 
   it "should be able to verify its certificate matches its key" do
     Puppet::SSL::Host.new("foo").should respond_to(:certificate_matches_key?)
   end
 
   it "should consider the certificate invalid if it cannot find a key" do
     host = Puppet::SSL::Host.new("foo")
     host.expects(:key).returns nil
 
     host.should_not be_certificate_matches_key
   end
 
   it "should consider the certificate invalid if it cannot find a certificate" do
     host = Puppet::SSL::Host.new("foo")
     host.expects(:key).returns mock("key")
     host.expects(:certificate).returns nil
 
     host.should_not be_certificate_matches_key
   end
 
   it "should consider the certificate invalid if the SSL certificate's key verification fails" do
     host = Puppet::SSL::Host.new("foo")
 
     key = mock 'key', :content => "private_key"
     sslcert = mock 'sslcert'
     certificate = mock 'cert', :content => sslcert
 
     host.stubs(:key).returns key
     host.stubs(:certificate).returns certificate
 
     sslcert.expects(:check_private_key).with("private_key").returns false
 
     host.should_not be_certificate_matches_key
   end
 
   it "should consider the certificate valid if the SSL certificate's key verification succeeds" do
     host = Puppet::SSL::Host.new("foo")
 
     key = mock 'key', :content => "private_key"
     sslcert = mock 'sslcert'
     certificate = mock 'cert', :content => sslcert
 
     host.stubs(:key).returns key
     host.stubs(:certificate).returns certificate
 
     sslcert.expects(:check_private_key).with("private_key").returns true
 
     host.should be_certificate_matches_key
   end
 
   describe "when specifying the CA location" do
     it "should support the location ':local'" do
       lambda { Puppet::SSL::Host.ca_location = :local }.should_not raise_error
     end
 
     it "should support the location ':remote'" do
       lambda { Puppet::SSL::Host.ca_location = :remote }.should_not raise_error
     end
 
     it "should support the location ':none'" do
       lambda { Puppet::SSL::Host.ca_location = :none }.should_not raise_error
     end
 
     it "should support the location ':only'" do
       lambda { Puppet::SSL::Host.ca_location = :only }.should_not raise_error
     end
 
     it "should not support other modes" do
       lambda { Puppet::SSL::Host.ca_location = :whatever }.should raise_error(ArgumentError)
     end
 
     describe "as 'local'" do
       before do
         Puppet::SSL::Host.ca_location = :local
       end
 
       it "should set the cache class for Certificate, CertificateRevocationList, and CertificateRequest as :file" do
         Puppet::SSL::Certificate.indirection.cache_class.should == :file
         Puppet::SSL::CertificateRequest.indirection.cache_class.should == :file
         Puppet::SSL::CertificateRevocationList.indirection.cache_class.should == :file
       end
 
       it "should set the terminus class for Key and Host as :file" do
         Puppet::SSL::Key.indirection.terminus_class.should == :file
         Puppet::SSL::Host.indirection.terminus_class.should == :file
       end
 
       it "should set the terminus class for Certificate, CertificateRevocationList, and CertificateRequest as :ca" do
         Puppet::SSL::Certificate.indirection.terminus_class.should == :ca
         Puppet::SSL::CertificateRequest.indirection.terminus_class.should == :ca
         Puppet::SSL::CertificateRevocationList.indirection.terminus_class.should == :ca
       end
     end
 
     describe "as 'remote'" do
       before do
         Puppet::SSL::Host.ca_location = :remote
       end
 
       it "should set the cache class for Certificate, CertificateRevocationList, and CertificateRequest as :file" do
         Puppet::SSL::Certificate.indirection.cache_class.should == :file
         Puppet::SSL::CertificateRequest.indirection.cache_class.should == :file
         Puppet::SSL::CertificateRevocationList.indirection.cache_class.should == :file
       end
 
       it "should set the terminus class for Key as :file" do
         Puppet::SSL::Key.indirection.terminus_class.should == :file
       end
 
       it "should set the terminus class for Host, Certificate, CertificateRevocationList, and CertificateRequest as :rest" do
         Puppet::SSL::Host.indirection.terminus_class.should == :rest
         Puppet::SSL::Certificate.indirection.terminus_class.should == :rest
         Puppet::SSL::CertificateRequest.indirection.terminus_class.should == :rest
         Puppet::SSL::CertificateRevocationList.indirection.terminus_class.should == :rest
       end
     end
 
     describe "as 'only'" do
       before do
         Puppet::SSL::Host.ca_location = :only
       end
 
       it "should set the terminus class for Key, Certificate, CertificateRevocationList, and CertificateRequest as :ca" do
         Puppet::SSL::Key.indirection.terminus_class.should == :ca
         Puppet::SSL::Certificate.indirection.terminus_class.should == :ca
         Puppet::SSL::CertificateRequest.indirection.terminus_class.should == :ca
         Puppet::SSL::CertificateRevocationList.indirection.terminus_class.should == :ca
       end
 
       it "should set the cache class for Certificate, CertificateRevocationList, and CertificateRequest to nil" do
         Puppet::SSL::Certificate.indirection.cache_class.should be_nil
         Puppet::SSL::CertificateRequest.indirection.cache_class.should be_nil
         Puppet::SSL::CertificateRevocationList.indirection.cache_class.should be_nil
       end
 
       it "should set the terminus class for Host to :file" do
         Puppet::SSL::Host.indirection.terminus_class.should == :file
       end
     end
 
     describe "as 'none'" do
       before do
         Puppet::SSL::Host.ca_location = :none
       end
 
       it "should set the terminus class for Key, Certificate, CertificateRevocationList, and CertificateRequest as :file" do
         Puppet::SSL::Key.indirection.terminus_class.should == :file
         Puppet::SSL::Certificate.indirection.terminus_class.should == :file
         Puppet::SSL::CertificateRequest.indirection.terminus_class.should == :file
         Puppet::SSL::CertificateRevocationList.indirection.terminus_class.should == :file
       end
 
       it "should set the terminus class for Host to 'none'" do
         lambda { Puppet::SSL::Host.indirection.terminus_class }.should raise_error(Puppet::DevError)
       end
     end
   end
 
   it "should have a class method for destroying all files related to a given host" do
     Puppet::SSL::Host.should respond_to(:destroy)
   end
 
   describe "when destroying a host's SSL files" do
     before do
       Puppet::SSL::Key.indirection.stubs(:destroy).returns false
       Puppet::SSL::Certificate.indirection.stubs(:destroy).returns false
       Puppet::SSL::CertificateRequest.indirection.stubs(:destroy).returns false
     end
 
     it "should destroy its certificate, certificate request, and key" do
       Puppet::SSL::Key.indirection.expects(:destroy).with("myhost")
       Puppet::SSL::Certificate.indirection.expects(:destroy).with("myhost")
       Puppet::SSL::CertificateRequest.indirection.expects(:destroy).with("myhost")
 
       Puppet::SSL::Host.destroy("myhost")
     end
 
     it "should return true if any of the classes returned true" do
       Puppet::SSL::Certificate.indirection.expects(:destroy).with("myhost").returns true
 
       Puppet::SSL::Host.destroy("myhost").should be_true
     end
 
     it "should report that nothing was deleted if none of the classes returned true" do
       Puppet::SSL::Host.destroy("myhost").should == "Nothing was deleted"
     end
   end
 
   describe "when initializing" do
     it "should default its name to the :certname setting" do
       Puppet.settings.expects(:value).with(:certname).returns "myname"
 
       Puppet::SSL::Host.new.name.should == "myname"
     end
 
     it "should downcase a passed in name" do
       Puppet::SSL::Host.new("Host.Domain.Com").name.should == "host.domain.com"
     end
 
     it "should downcase the certname if it's used" do
       Puppet.settings.expects(:value).with(:certname).returns "Host.Domain.Com"
       Puppet::SSL::Host.new.name.should == "host.domain.com"
     end
 
     it "should indicate that it is a CA host if its name matches the ca_name constant" do
       Puppet::SSL::Host.stubs(:ca_name).returns "myca"
       Puppet::SSL::Host.new("myca").should be_ca
     end
   end
 
   describe "when managing its private key" do
     before do
       @realkey = "mykey"
       @key = Puppet::SSL::Key.new("mykey")
       @key.content = @realkey
     end
 
     it "should return nil if the key is not set and cannot be found" do
       Puppet::SSL::Key.indirection.expects(:find).with("myname").returns(nil)
       @host.key.should be_nil
     end
 
     it "should find the key in the Key class and return the Puppet instance" do
       Puppet::SSL::Key.indirection.expects(:find).with("myname").returns(@key)
       @host.key.should equal(@key)
     end
 
     it "should be able to generate and save a new key" do
       Puppet::SSL::Key.expects(:new).with("myname").returns(@key)
 
       @key.expects(:generate)
       Puppet::SSL::Key.indirection.expects(:save)
 
       @host.generate_key.should be_true
       @host.key.should equal(@key)
     end
 
     it "should not retain keys that could not be saved" do
       Puppet::SSL::Key.expects(:new).with("myname").returns(@key)
 
       @key.stubs(:generate)
       Puppet::SSL::Key.indirection.expects(:save).raises "eh"
 
       lambda { @host.generate_key }.should raise_error
       @host.key.should be_nil
     end
 
     it "should return any previously found key without requerying" do
       Puppet::SSL::Key.indirection.expects(:find).with("myname").returns(@key).once
       @host.key.should equal(@key)
       @host.key.should equal(@key)
     end
   end
 
   describe "when managing its certificate request" do
     before do
       @realrequest = "real request"
       @request = Puppet::SSL::CertificateRequest.new("myname")
       @request.content = @realrequest
     end
 
     it "should return nil if the key is not set and cannot be found" do
       Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myname").returns(nil)
       @host.certificate_request.should be_nil
     end
 
     it "should find the request in the Key class and return it and return the Puppet SSL request" do
       Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myname").returns @request
 
       @host.certificate_request.should equal(@request)
     end
 
     it "should generate a new key when generating the cert request if no key exists" do
       Puppet::SSL::CertificateRequest.expects(:new).with("myname").returns @request
 
       key = stub 'key', :public_key => mock("public_key"), :content => "mycontent"
 
       @host.expects(:key).times(2).returns(nil).then.returns(key)
       @host.expects(:generate_key).returns(key)
 
       @request.stubs(:generate)
       Puppet::SSL::CertificateRequest.indirection.stubs(:save)
 
       @host.generate_certificate_request
     end
 
     it "should be able to generate and save a new request using the private key" do
       Puppet::SSL::CertificateRequest.expects(:new).with("myname").returns @request
 
       key = stub 'key', :public_key => mock("public_key"), :content => "mycontent"
       @host.stubs(:key).returns(key)
       @request.expects(:generate).with("mycontent", {})
       Puppet::SSL::CertificateRequest.indirection.expects(:save).with(@request)
 
       @host.generate_certificate_request.should be_true
       @host.certificate_request.should equal(@request)
     end
 
     it "should return any previously found request without requerying" do
       Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myname").returns(@request).once
 
       @host.certificate_request.should equal(@request)
       @host.certificate_request.should equal(@request)
     end
 
     it "should not keep its certificate request in memory if the request cannot be saved" do
       Puppet::SSL::CertificateRequest.expects(:new).with("myname").returns @request
 
       key = stub 'key', :public_key => mock("public_key"), :content => "mycontent"
       @host.stubs(:key).returns(key)
       @request.stubs(:generate)
       @request.stubs(:name).returns("myname")
       terminus = stub 'terminus'
       Puppet::SSL::CertificateRequest.indirection.expects(:prepare).returns(terminus)
       terminus.expects(:save).with { |req| req.instance == @request && req.key == "myname" }.raises "eh"
 
       lambda { @host.generate_certificate_request }.should raise_error
 
       @host.instance_eval { @certificate_request }.should be_nil
     end
   end
 
   describe "when managing its certificate" do
     before do
       @realcert = mock 'certificate'
       @cert = stub 'cert', :content => @realcert
 
       @host.stubs(:key).returns mock("key")
       @host.stubs(:certificate_matches_key?).returns true
     end
 
     it "should find the CA certificate if it does not have a certificate" do
       Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME).returns mock("cacert")
       Puppet::SSL::Certificate.indirection.stubs(:find).with("myname").returns @cert
 
       @host.certificate
     end
 
     it "should not find the CA certificate if it is the CA host" do
       @host.expects(:ca?).returns true
       Puppet::SSL::Certificate.indirection.stubs(:find)
       Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME).never
 
       @host.certificate
     end
 
     it "should return nil if it cannot find a CA certificate" do
       Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME).returns nil
       Puppet::SSL::Certificate.indirection.expects(:find).with("myname").never
 
       @host.certificate.should be_nil
     end
 
     it "should find the key if it does not have one" do
       Puppet::SSL::Certificate.indirection.stubs(:find)
       @host.expects(:key).returns mock("key")
 
       @host.certificate
     end
 
     it "should generate the key if one cannot be found" do
       Puppet::SSL::Certificate.indirection.stubs(:find)
 
       @host.expects(:key).returns nil
       @host.expects(:generate_key)
 
       @host.certificate
     end
 
     it "should find the certificate in the Certificate class and return the Puppet certificate instance" do
       Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME).returns mock("cacert")
       Puppet::SSL::Certificate.indirection.expects(:find).with("myname").returns @cert
 
       @host.certificate.should equal(@cert)
     end
 
     it "should fail if the found certificate does not match the private key" do
       @host.expects(:certificate_matches_key?).returns false
 
       Puppet::SSL::Certificate.indirection.stubs(:find).returns @cert
 
       lambda { @host.certificate }.should raise_error(Puppet::Error)
     end
 
     it "should return any previously found certificate" do
       Puppet::SSL::Certificate.indirection.expects(:find).with(Puppet::SSL::CA_NAME).returns mock("cacert")
       Puppet::SSL::Certificate.indirection.expects(:find).with("myname").returns(@cert).once
 
       @host.certificate.should equal(@cert)
       @host.certificate.should equal(@cert)
     end
   end
 
   it "should have a method for listing certificate hosts" do
     Puppet::SSL::Host.should respond_to(:search)
   end
 
   describe "when listing certificate hosts" do
     it "should default to listing all clients with any file types" do
       Puppet::SSL::Key.indirection.expects(:search).returns []
       Puppet::SSL::Certificate.indirection.expects(:search).returns []
       Puppet::SSL::CertificateRequest.indirection.expects(:search).returns []
       Puppet::SSL::Host.search
     end
 
     it "should be able to list only clients with a key" do
       Puppet::SSL::Key.indirection.expects(:search).returns []
       Puppet::SSL::Certificate.indirection.expects(:search).never
       Puppet::SSL::CertificateRequest.indirection.expects(:search).never
       Puppet::SSL::Host.search :for => Puppet::SSL::Key
     end
 
     it "should be able to list only clients with a certificate" do
       Puppet::SSL::Key.indirection.expects(:search).never
       Puppet::SSL::Certificate.indirection.expects(:search).returns []
       Puppet::SSL::CertificateRequest.indirection.expects(:search).never
       Puppet::SSL::Host.search :for => Puppet::SSL::Certificate
     end
 
     it "should be able to list only clients with a certificate request" do
       Puppet::SSL::Key.indirection.expects(:search).never
       Puppet::SSL::Certificate.indirection.expects(:search).never
       Puppet::SSL::CertificateRequest.indirection.expects(:search).returns []
       Puppet::SSL::Host.search :for => Puppet::SSL::CertificateRequest
     end
 
     it "should return a Host instance created with the name of each found instance", :'fails_on_ruby_1.9.2' => true do
       key = stub 'key', :name => "key"
       cert = stub 'cert', :name => "cert"
       csr = stub 'csr', :name => "csr"
 
       Puppet::SSL::Key.indirection.expects(:search).returns [key]
       Puppet::SSL::Certificate.indirection.expects(:search).returns [cert]
       Puppet::SSL::CertificateRequest.indirection.expects(:search).returns [csr]
 
       returned = []
       %w{key cert csr}.each do |name|
         result = mock(name)
         returned << result
         Puppet::SSL::Host.expects(:new).with(name).returns result
       end
 
       result = Puppet::SSL::Host.search
       returned.each do |r|
         result.should be_include(r)
       end
     end
   end
 
   it "should have a method for generating all necessary files" do
     Puppet::SSL::Host.new("me").should respond_to(:generate)
   end
 
   describe "when generating files" do
     before do
       @host = Puppet::SSL::Host.new("me")
       @host.stubs(:generate_key)
       @host.stubs(:generate_certificate_request)
     end
 
     it "should generate a key if one is not present" do
       @host.stubs(:key).returns nil
       @host.expects(:generate_key)
 
       @host.generate
     end
 
     it "should generate a certificate request if one is not present" do
       @host.expects(:certificate_request).returns nil
       @host.expects(:generate_certificate_request)
 
       @host.generate
     end
 
     describe "and it can create a certificate authority" do
       before do
         @ca = mock 'ca'
         Puppet::SSL::CertificateAuthority.stubs(:instance).returns @ca
       end
 
       it "should use the CA to sign its certificate request if it does not have a certificate" do
         @host.expects(:certificate).returns nil
 
         @ca.expects(:sign).with(@host.name, true)
 
         @host.generate
       end
     end
 
     describe "and it cannot create a certificate authority" do
       before do
         Puppet::SSL::CertificateAuthority.stubs(:instance).returns nil
       end
 
       it "should seek its certificate" do
         @host.expects(:certificate)
 
         @host.generate
       end
     end
   end
 
   it "should have a method for creating an SSL store" do
     Puppet::SSL::Host.new("me").should respond_to(:ssl_store)
   end
 
   it "should always return the same store" do
     host = Puppet::SSL::Host.new("foo")
     store = mock 'store'
     store.stub_everything
     OpenSSL::X509::Store.expects(:new).returns store
     host.ssl_store.should equal(host.ssl_store)
   end
 
   describe "when creating an SSL store" do
     before do
       @host = Puppet::SSL::Host.new("me")
       @store = mock 'store'
       @store.stub_everything
       OpenSSL::X509::Store.stubs(:new).returns @store
 
       Puppet.settings.stubs(:value).with(:localcacert).returns "ssl_host_testing"
 
       Puppet::SSL::CertificateRevocationList.indirection.stubs(:find).returns(nil)
     end
 
     it "should accept a purpose" do
       @store.expects(:purpose=).with "my special purpose"
       @host.ssl_store("my special purpose")
     end
 
     it "should default to OpenSSL::X509::PURPOSE_ANY as the purpose" do
       @store.expects(:purpose=).with OpenSSL::X509::PURPOSE_ANY
       @host.ssl_store
     end
 
     it "should add the local CA cert file" do
       Puppet.settings.stubs(:value).with(:localcacert).returns "/ca/cert/file"
       @store.expects(:add_file).with "/ca/cert/file"
       @host.ssl_store
     end
 
     describe "and a CRL is available" do
       before do
         @crl = stub 'crl', :content => "real_crl"
         Puppet::SSL::CertificateRevocationList.indirection.stubs(:find).returns @crl
         Puppet.settings.stubs(:value).with(:certificate_revocation).returns true
       end
 
       it "should add the CRL" do
         @store.expects(:add_crl).with "real_crl"
         @host.ssl_store
       end
 
       it "should set the flags to OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK" do
         @store.expects(:flags=).with OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK
         @host.ssl_store
       end
     end
   end
 
   describe "when waiting for a cert" do
     before do
       @host = Puppet::SSL::Host.new("me")
     end
 
     it "should generate its certificate request and attempt to read the certificate again if no certificate is found" do
       @host.expects(:certificate).times(2).returns(nil).then.returns "foo"
       @host.expects(:generate)
       @host.wait_for_cert(1)
     end
 
     it "should catch and log errors during CSR saving" do
       @host.expects(:certificate).times(2).returns(nil).then.returns "foo"
       @host.expects(:generate).raises(RuntimeError).then.returns nil
       @host.stubs(:sleep)
       @host.wait_for_cert(1)
     end
 
     it "should sleep and retry after failures saving the CSR if waitforcert is enabled" do
       @host.expects(:certificate).times(2).returns(nil).then.returns "foo"
       @host.expects(:generate).raises(RuntimeError).then.returns nil
       @host.expects(:sleep).with(1)
       @host.wait_for_cert(1)
     end
 
     it "should exit after failures saving the CSR of waitforcert is disabled" do
       @host.expects(:certificate).returns(nil)
       @host.expects(:generate).raises(RuntimeError)
       @host.expects(:puts)
       expect { @host.wait_for_cert(0) }.to exit_with 1
     end
 
     it "should exit if the wait time is 0 and it can neither find nor retrieve a certificate" do
       @host.stubs(:certificate).returns nil
       @host.expects(:generate)
       @host.expects(:puts)
       expect { @host.wait_for_cert(0) }.to exit_with 1
     end
 
     it "should sleep for the specified amount of time if no certificate is found after generating its certificate request" do
       @host.expects(:certificate).times(3).returns(nil).then.returns(nil).then.returns "foo"
       @host.expects(:generate)
 
       @host.expects(:sleep).with(1)
 
       @host.wait_for_cert(1)
     end
 
     it "should catch and log exceptions during certificate retrieval" do
       @host.expects(:certificate).times(3).returns(nil).then.raises(RuntimeError).then.returns("foo")
       @host.stubs(:generate)
       @host.stubs(:sleep)
 
       Puppet.expects(:err)
 
       @host.wait_for_cert(1)
     end
   end
 
   describe "when handling PSON", :unless => Puppet.features.microsoft_windows? do
     include PuppetSpec::Files
 
     before do
       Puppet[:vardir] = tmpdir("ssl_test_vardir")
       Puppet[:ssldir] = tmpdir("ssl_test_ssldir")
-      Puppet::SSLCertificates::CA.new.mkrootcert
       # localcacert is where each client stores the CA certificate
       # cacert is where the master stores the CA certificate
       # Since we need to play the role of both for testing we need them to be the same and exist
       Puppet[:cacert] = Puppet[:localcacert]
 
       @ca=Puppet::SSL::CertificateAuthority.new
     end
 
     describe "when converting to PSON" do
       it "should be able to identify a host with an unsigned certificate request" do
         host = Puppet::SSL::Host.new("bazinga")
         host.generate_certificate_request
         pson_hash = {
           "fingerprint"          => host.certificate_request.fingerprint,
           "desired_state"        => 'requested',
           "name"                 => host.name
         }
 
         result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
         result["fingerprint"].should == pson_hash["fingerprint"]
         result["name"].should        == pson_hash["name"]
         result["state"].should       == pson_hash["desired_state"]
       end
 
       it "should be able to identify a host with a signed certificate" do
         host = Puppet::SSL::Host.new("bazinga")
         host.generate_certificate_request
         @ca.sign(host.name)
         pson_hash = {
           "fingerprint"          => Puppet::SSL::Certificate.indirection.find(host.name).fingerprint,
           "desired_state"        => 'signed',
           "name"                 => host.name,
         }
 
         result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
         result["fingerprint"].should == pson_hash["fingerprint"]
         result["name"].should        == pson_hash["name"]
         result["state"].should       == pson_hash["desired_state"]
       end
 
       it "should be able to identify a host with a revoked certificate" do
         host = Puppet::SSL::Host.new("bazinga")
         host.generate_certificate_request
         @ca.sign(host.name)
         @ca.revoke(host.name)
         pson_hash = {
           "fingerprint"          => Puppet::SSL::Certificate.indirection.find(host.name).fingerprint,
           "desired_state"        => 'revoked',
           "name"                 => host.name,
         }
 
         result = PSON.parse(Puppet::SSL::Host.new(host.name).to_pson)
         result["fingerprint"].should == pson_hash["fingerprint"]
         result["name"].should        == pson_hash["name"]
         result["state"].should       == pson_hash["desired_state"]
       end
     end
 
     describe "when converting from PSON" do
       it "should return a Puppet::SSL::Host object with the specified desired state" do
         host = Puppet::SSL::Host.new("bazinga")
         host.desired_state="signed"
         pson_hash = {
           "name"  => host.name,
           "desired_state" => host.desired_state,
         }
         generated_host = Puppet::SSL::Host.from_pson(pson_hash)
         generated_host.desired_state.should == host.desired_state
         generated_host.name.should == host.name
       end
     end
   end
 end