diff --git a/lib/puppet/network/http/handler.rb b/lib/puppet/network/http/handler.rb
index d20d9776f..a8aa1aaeb 100644
--- a/lib/puppet/network/http/handler.rb
+++ b/lib/puppet/network/http/handler.rb
@@ -1,187 +1,186 @@
 module Puppet::Network::HTTP
 end
 
 require 'puppet/network/http'
 require 'puppet/network/http/api/v1'
 require 'puppet/network/authentication'
 require 'puppet/network/rights'
 require 'puppet/util/profiler'
 require 'puppet/util/profiler/aggregate'
 require 'resolv'
 
 module Puppet::Network::HTTP::Handler
   include Puppet::Network::Authentication
   include Puppet::Network::HTTP::Issues
 
   # These shouldn't be allowed to be set by clients
   # in the query string, for security reasons.
   DISALLOWED_KEYS = ["node", "ip"]
 
   def register(routes)
     # There's got to be a simpler way to do this, right?
     dupes = {}
     routes.each { |r| dupes[r.path_matcher] = (dupes[r.path_matcher] || 0) + 1 }
     dupes = dupes.collect { |pm, count| pm if count > 1 }.compact
     if dupes.count > 0
       raise ArgumentError, "Given multiple routes with identical path regexes: #{dupes.map{ |rgx| rgx.inspect }.join(', ')}"
     end
 
     @routes = routes
     Puppet.debug("Routes Registered:")
     @routes.each do |route|
       Puppet.debug(route.inspect)
     end
   end
 
   # Retrieve all headers from the http request, as a hash with the header names
   # (lower-cased) as the keys
   def headers(request)
     raise NotImplementedError
   end
 
   def format_to_mime(format)
     format.is_a?(Puppet::Network::Format) ? format.mime : format
   end
 
   # handle an HTTP request
   def process(request, response)
     new_response = Puppet::Network::HTTP::Response.new(self, response)
 
     request_headers = headers(request)
     request_params = params(request)
     request_method = http_method(request)
     request_path = path(request)
 
     new_request = Puppet::Network::HTTP::Request.new(request_headers, request_params, request_method, request_path, request_path, client_cert(request), body(request))
 
     response[Puppet::Network::HTTP::HEADER_PUPPET_VERSION] = Puppet.version
 
     profiler = configure_profiler(request_headers, request_params)
-    warn_if_near_expiration(new_request.client_cert)
 
     Puppet::Util::Profiler.profile("Processed request #{request_method} #{request_path}", [:http, request_method, request_path]) do
       if route = @routes.find { |route| route.matches?(new_request) }
         route.process(new_request, new_response)
       else
         raise Puppet::Network::HTTP::Error::HTTPNotFoundError.new("No route for #{new_request.method} #{new_request.path}", HANDLER_NOT_FOUND)
       end
     end
 
   rescue Puppet::Network::HTTP::Error::HTTPError => e
     Puppet.info(e.message)
     new_response.respond_with(e.status, "application/json", e.to_json)
   rescue Exception => e
     http_e = Puppet::Network::HTTP::Error::HTTPServerError.new(e)
     Puppet.err(http_e.message)
     new_response.respond_with(http_e.status, "application/json", http_e.to_json)
   ensure
     if profiler
       remove_profiler(profiler)
     end
     cleanup(request)
   end
 
   # Set the response up, with the body and status.
   def set_response(response, body, status = 200)
     raise NotImplementedError
   end
 
   # Set the specified format as the content type of the response.
   def set_content_type(response, format)
     raise NotImplementedError
   end
 
   # resolve node name from peer's ip address
   # this is used when the request is unauthenticated
   def resolve_node(result)
     begin
       return Resolv.getname(result[:ip])
     rescue => detail
       Puppet.err "Could not resolve #{result[:ip]}: #{detail}"
     end
     result[:ip]
   end
 
   private
 
   # methods to be overridden by the including web server class
 
   def http_method(request)
     raise NotImplementedError
   end
 
   def path(request)
     raise NotImplementedError
   end
 
   def request_key(request)
     raise NotImplementedError
   end
 
   def body(request)
     raise NotImplementedError
   end
 
   def params(request)
     raise NotImplementedError
   end
 
   def client_cert(request)
     raise NotImplementedError
   end
 
   def cleanup(request)
     # By default, there is nothing to cleanup.
   end
 
   def decode_params(params)
     params.select { |key, _| allowed_parameter?(key) }.inject({}) do |result, ary|
       param, value = ary
       result[param.to_sym] = parse_parameter_value(param, value)
       result
     end
   end
 
   def allowed_parameter?(name)
     not (name.nil? || name.empty? || DISALLOWED_KEYS.include?(name))
   end
 
   def parse_parameter_value(param, value)
     case value
     when /^---/
       Puppet.debug("Found YAML while processing request parameter #{param} (value: <#{value}>)")
       Puppet.deprecation_warning("YAML in network requests is deprecated and will be removed in a future version. See http://links.puppetlabs.com/deprecate_yaml_on_network")
       YAML.load(value, :safe => true, :deserialize_symbols => true)
     when Array
       value.collect { |v| parse_primitive_parameter_value(v) }
     else
       parse_primitive_parameter_value(value)
     end
   end
 
   def parse_primitive_parameter_value(value)
     case value
     when "true"
       true
     when "false"
       false
     when /^\d+$/
       Integer(value)
     when /^\d+\.\d+$/
       value.to_f
     else
       value
     end
   end
 
   def configure_profiler(request_headers, request_params)
     if (request_headers.has_key?(Puppet::Network::HTTP::HEADER_ENABLE_PROFILING.downcase) or Puppet[:profile])
       Puppet::Util::Profiler.add_profiler(Puppet::Util::Profiler::Aggregate.new(Puppet.method(:debug), request_params.object_id))
     end
   end
 
   def remove_profiler(profiler)
     profiler.shutdown
     Puppet::Util::Profiler.remove_profiler(profiler)
   end
 end
diff --git a/lib/puppet/network/http/rack/rest.rb b/lib/puppet/network/http/rack/rest.rb
index 23d73bf93..3ca79c8ae 100644
--- a/lib/puppet/network/http/rack/rest.rb
+++ b/lib/puppet/network/http/rack/rest.rb
@@ -1,136 +1,138 @@
 require 'openssl'
 require 'cgi'
 require 'puppet/network/http/handler'
 require 'puppet/util/ssl'
 
 class Puppet::Network::HTTP::RackREST
   include Puppet::Network::HTTP::Handler
 
   ContentType = 'Content-Type'.freeze
 
   CHUNK_SIZE = 8192
 
   class RackFile
     def initialize(file)
       @file = file
     end
 
     def each
       while chunk = @file.read(CHUNK_SIZE)
         yield chunk
       end
     end
 
     def close
       @file.close
     end
   end
 
   def initialize(args={})
     super()
     register([Puppet::Network::HTTP::API::V2.routes, Puppet::Network::HTTP::API::V1.routes])
   end
 
   def set_content_type(response, format)
     response[ContentType] = format_to_mime(format)
   end
 
   # produce the body of the response
   def set_response(response, result, status = 200)
     response.status = status
     unless result.is_a?(File)
       response.write result
     else
       response["Content-Length"] = result.stat.size.to_s
       response.body = RackFile.new(result)
     end
   end
 
   # Retrieve all headers from the http request, as a map.
   def headers(request)
     headers = request.env.select {|k,v| k.start_with? 'HTTP_'}.inject({}) do |m, (k,v)|
       m[k.sub(/^HTTP_/, '').gsub('_','-').downcase] = v
       m
     end
     headers['content-type'] = request.content_type
     headers
   end
 
   # Return which HTTP verb was used in this request.
   def http_method(request)
     request.request_method
   end
 
   # Return the query params for this request.
   def params(request)
     if request.post?
       params = request.params
     else
       # rack doesn't support multi-valued query parameters,
       # e.g. ignore, so parse them ourselves
       params = CGI.parse(request.query_string)
       convert_singular_arrays_to_value(params)
     end
     result = decode_params(params)
     result.merge(extract_client_info(request))
   end
 
   # what path was requested? (this is, without any query parameters)
   def path(request)
     request.path
   end
 
   # return the request body
   def body(request)
     request.body.read
   end
 
   def client_cert(request)
     # This environment variable is set by mod_ssl, note that it
     # requires the `+ExportCertData` option in the `SSLOptions` directive
     cert = request.env['SSL_CLIENT_CERT']
     # NOTE: The SSL_CLIENT_CERT environment variable will be the empty string
     # when Puppet agent nodes have not yet obtained a signed certificate.
     if cert.nil? || cert.empty?
       nil
     else
-      Puppet::SSL::Certificate.from_instance(OpenSSL::X509::Certificate.new(cert))
+      cert = Puppet::SSL::Certificate.from_instance(OpenSSL::X509::Certificate.new(cert))
+      warn_if_near_expiration(cert)
+      cert
     end
   end
 
   # Passenger freaks out if we finish handling the request without reading any
   # part of the body, so make sure we have.
   def cleanup(request)
     request.body.read(1)
     nil
   end
 
   def extract_client_info(request)
     result = {}
     result[:ip] = request.ip
 
     # if we find SSL info in the headers, use them to get a hostname from the CN.
     # try this with :ssl_client_header, which defaults should work for
     # Apache with StdEnvVars.
     subj_str = request.env[Puppet[:ssl_client_header]]
     subject = Puppet::Util::SSL.subject_from_dn(subj_str || "")
 
     if cn = Puppet::Util::SSL.cn_from_subject(subject)
       result[:node] = cn
       result[:authenticated] = (request.env[Puppet[:ssl_client_verify_header]] == 'SUCCESS')
     else
       result[:node] = resolve_node(result)
       result[:authenticated] = false
     end
 
     result
   end
 
   def convert_singular_arrays_to_value(hash)
     hash.each do |key, value|
       if value.size == 1
         hash[key] = value.first
       end
     end
   end
 end
diff --git a/lib/puppet/network/http/webrick/rest.rb b/lib/puppet/network/http/webrick/rest.rb
index 64c859a10..ae0867dfb 100644
--- a/lib/puppet/network/http/webrick/rest.rb
+++ b/lib/puppet/network/http/webrick/rest.rb
@@ -1,102 +1,104 @@
 require 'puppet/network/http/handler'
 require 'resolv'
 require 'webrick'
 require 'puppet/util/ssl'
 
 class Puppet::Network::HTTP::WEBrickREST < WEBrick::HTTPServlet::AbstractServlet
 
   include Puppet::Network::HTTP::Handler
 
   def self.mutex
     @mutex ||= Mutex.new
   end
 
   def initialize(server)
     raise ArgumentError, "server is required" unless server
     register([Puppet::Network::HTTP::API::V2.routes, Puppet::Network::HTTP::API::V1.routes])
     super(server)
   end
 
   # Retrieve the request parameters, including authentication information.
   def params(request)
     params = request.query || {}
 
     params = Hash[params.collect do |key, value|
       all_values = value.list
       [key, all_values.length == 1 ? value : all_values]
     end]
 
     params = decode_params(params)
     params.merge(client_information(request))
   end
 
   # WEBrick uses a service method to respond to requests.  Simply delegate to
   # the handler response method.
   def service(request, response)
     self.class.mutex.synchronize do
       process(request, response)
     end
   end
 
   def headers(request)
     result = {}
     request.each do |k, v|
       result[k.downcase] = v
     end
     result
   end
 
   def http_method(request)
     request.request_method
   end
 
   def path(request)
     request.path
   end
 
   def body(request)
     request.body
   end
 
   def client_cert(request)
     if cert = request.client_cert
-      Puppet::SSL::Certificate.from_instance(cert)
+      cert = Puppet::SSL::Certificate.from_instance(cert)
+      warn_if_near_expiration(cert)
+      cert
     else
       nil
     end
   end
 
   # Set the specified format as the content type of the response.
   def set_content_type(response, format)
     response["content-type"] = format_to_mime(format)
   end
 
   def set_response(response, result, status = 200)
     response.status = status
     if status >= 200 and status != 304
       response.body = result
       response["content-length"] = result.stat.size if result.is_a?(File)
     end
   end
 
   # Retrieve node/cert/ip information from the request object.
   def client_information(request)
     result = {}
     if peer = request.peeraddr and ip = peer[3]
       result[:ip] = ip
     end
 
     # If they have a certificate (which will almost always be true)
     # then we get the hostname from the cert, instead of via IP
     # info
     result[:authenticated] = false
     if cert = request.client_cert and cn = Puppet::Util::SSL.cn_from_subject(cert.subject)
       result[:node] = cn
       result[:authenticated] = true
     else
       result[:node] = resolve_node(result)
     end
 
     result
   end
 end
diff --git a/spec/unit/network/authentication_spec.rb b/spec/unit/network/authentication_spec.rb
index 8f3653cad..5e2f2de87 100755
--- a/spec/unit/network/authentication_spec.rb
+++ b/spec/unit/network/authentication_spec.rb
@@ -1,100 +1,104 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
 load 'puppet/network/authentication.rb'
 
 class AuthenticationTest
   include Puppet::Network::Authentication
 end
 
 describe Puppet::Network::Authentication do
   subject     { AuthenticationTest.new }
   let(:now)   { Time.now }
   let(:cert)  { Puppet::SSL::Certificate.new('cert') }
   let(:host)  { stub 'host', :certificate => cert }
 
   # this is necessary since the logger is a class variable, and it needs to be stubbed
   def reload_module
     load 'puppet/network/authentication.rb'
   end
 
   describe "when warning about upcoming expirations" do
     before do
       Puppet::SSL::CertificateAuthority.stubs(:ca?).returns(false)
       Puppet::FileSystem.stubs(:exist?).returns(false)
     end
 
     it "should check the expiration of the CA certificate" do
       ca = stub 'ca', :host => host
       Puppet::SSL::CertificateAuthority.stubs(:ca?).returns(true)
       Puppet::SSL::CertificateAuthority.stubs(:instance).returns(ca)
       cert.expects(:near_expiration?).returns(false)
       subject.warn_if_near_expiration
     end
 
     context "when examining the local host" do
       before do
         Puppet::SSL::Host.stubs(:localhost).returns(host)
         Puppet::FileSystem.stubs(:exist?).with(Puppet[:hostcert]).returns(true)
       end
 
       it "should not load the localhost certificate if the local CA certificate is missing" do
         # Redmine-21869: Infinite recursion occurs if CA cert is missing.
         Puppet::FileSystem.stubs(:exist?).with(Puppet[:localcacert]).returns(false)
         host.unstub(:certificate)
         host.expects(:certificate).never
         subject.warn_if_near_expiration
       end
 
       it "should check the expiration of the localhost certificate if the local CA certificate is present" do
         Puppet::FileSystem.stubs(:exist?).with(Puppet[:localcacert]).returns(true)
         cert.expects(:near_expiration?).returns(false)
         subject.warn_if_near_expiration
       end
     end
 
     it "should check the expiration of any certificates passed in as arguments" do
       cert.expects(:near_expiration?).twice.returns(false)
       subject.warn_if_near_expiration(cert, cert)
     end
 
     it "should accept instances of OpenSSL::X509::Certificate" do
       raw_cert = stub 'cert'
       raw_cert.stubs(:is_a?).with(OpenSSL::X509::Certificate).returns(true)
       Puppet::SSL::Certificate.stubs(:from_instance).with(raw_cert).returns(cert)
       cert.expects(:near_expiration?).returns(false)
       subject.warn_if_near_expiration(raw_cert)
     end
 
     it "should use a rate-limited logger for expiration warnings that uses `runinterval` as its interval" do
       Puppet::Util::Log::RateLimitedLogger.expects(:new).with(Puppet[:runinterval])
       reload_module
     end
 
     context "in the logs" do
       let(:logger) { stub 'logger' }
 
       before do
         Puppet::Util::Log::RateLimitedLogger.stubs(:new).returns(logger)
         reload_module
         cert.stubs(:near_expiration?).returns(true)
         cert.stubs(:expiration).returns(now)
         cert.stubs(:unmunged_name).returns('foo')
       end
 
+      after(:all) do
+        reload_module
+      end
+
       it "should log a warning if a certificate's expiration is near" do
         logger.expects(:warning)
         subject.warn_if_near_expiration(cert)
       end
 
       it "should use the certificate's unmunged name in the message" do
         logger.expects(:warning).with { |message| message.include? 'foo' }
         subject.warn_if_near_expiration(cert)
       end
 
       it "should show certificate's expiration date in the message using ISO 8601 format" do
         logger.expects(:warning).with { |message| message.include? now.strftime('%Y-%m-%dT%H:%M:%S%Z') }
         subject.warn_if_near_expiration(cert)
       end
     end
   end
 end
diff --git a/spec/unit/network/http/handler_spec.rb b/spec/unit/network/http/handler_spec.rb
index caa372180..25df9d270 100755
--- a/spec/unit/network/http/handler_spec.rb
+++ b/spec/unit/network/http/handler_spec.rb
@@ -1,241 +1,232 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
 require 'puppet/indirector_testing'
 
 require 'puppet/network/authorization'
 require 'puppet/network/authentication'
 
 require 'puppet/network/http'
 
 describe Puppet::Network::HTTP::Handler do
   before :each do
     Puppet::IndirectorTesting.indirection.terminus_class = :memory
   end
 
   let(:indirection) { Puppet::IndirectorTesting.indirection }
 
   def a_request(method = "HEAD", path = "/production/#{indirection.name}/unknown")
     {
       :accept_header => "pson",
       :content_type_header => "text/yaml",
       :http_method => method,
       :path => path,
       :params => {},
       :client_cert => nil,
       :headers => {},
       :body => nil
     }
   end
 
   let(:handler) { TestingHandler.new() }
 
   describe "the HTTP Handler" do
     def respond(text)
       lambda { |req, res| res.respond_with(200, "text/plain", text) }
     end
 
     it "hands the request to the first route that matches the request path" do
       handler = TestingHandler.new(
         Puppet::Network::HTTP::Route.path(%r{^/foo}).get(respond("skipped")),
         Puppet::Network::HTTP::Route.path(%r{^/vtest}).get(respond("used")),
         Puppet::Network::HTTP::Route.path(%r{^/vtest/foo}).get(respond("ignored")))
 
       req = a_request("GET", "/vtest/foo")
       res = {}
 
       handler.process(req, res)
 
       expect(res[:body]).to eq("used")
     end
 
     it "raises an error if multiple routes with the same path regex are registered" do
       expect do
         handler = TestingHandler.new(
           Puppet::Network::HTTP::Route.path(%r{^/foo}).get(respond("ignored")),
           Puppet::Network::HTTP::Route.path(%r{^/foo}).post(respond("also ignored")))
       end.to raise_error(ArgumentError)
     end
 
     it "raises an HTTP not found error if no routes match" do
       handler = TestingHandler.new
 
       req = a_request("GET", "/vtest/foo")
       res = {}
 
       handler.process(req, res)
 
       res_body = JSON(res[:body])
 
       expect(res[:content_type_header]).to eq("application/json")
       expect(res_body["issue_kind"]).to eq("HANDLER_NOT_FOUND")
       expect(res_body["message"]).to eq("Not Found: No route for GET /vtest/foo")
       expect(res[:status]).to eq(404)
     end
 
     it "returns a structured error response with a stacktrace when the server encounters an internal error" do
       handler = TestingHandler.new(
         Puppet::Network::HTTP::Route.path(/.*/).get(lambda { |_, _| raise Exception.new("the sky is falling!")}))
 
       req = a_request("GET", "/vtest/foo")
       res = {}
 
       handler.process(req, res)
 
       res_body = JSON(res[:body])
 
       expect(res[:content_type_header]).to eq("application/json")
       expect(res_body["issue_kind"]).to eq(Puppet::Network::HTTP::Issues::RUNTIME_ERROR.to_s)
       expect(res_body["message"]).to eq("Server Error: the sky is falling!")
       expect(res_body["stacktrace"].is_a?(Array) && !res_body["stacktrace"].empty?).to be_true
       expect(res_body["stacktrace"][0]).to match("spec/unit/network/http/handler_spec.rb")
       expect(res[:status]).to eq(500)
     end
 
   end
 
   describe "when processing a request" do
     let(:response) do
       { :status => 200 }
     end
 
     before do
       handler.stubs(:check_authorization)
       handler.stubs(:warn_if_near_expiration)
     end
 
-    it "should check the client certificate for upcoming expiration" do
-      request = a_request
-      cert = mock 'cert'
-      handler.expects(:client_cert).returns(cert).with(request)
-      handler.expects(:warn_if_near_expiration).with(cert)
-
-      handler.process(request, response)
-    end
-
     it "should setup a profiler when the puppet-profiling header exists" do
       request = a_request
       request[:headers][Puppet::Network::HTTP::HEADER_ENABLE_PROFILING.downcase] = "true"
 
       p = HandlerTestProfiler.new
 
       Puppet::Util::Profiler.expects(:add_profiler).with { |profiler|
         profiler.is_a? Puppet::Util::Profiler::WallClock
       }.returns(p)
 
       Puppet::Util::Profiler.expects(:remove_profiler).with { |profiler|
         profiler == p
       }
 
       handler.process(request, response)
     end
 
     it "should not setup profiler when the profile parameter is missing" do
       request = a_request
       request[:params] = { }
 
       Puppet::Util::Profiler.expects(:add_profiler).never
 
       handler.process(request, response)
     end
 
     it "should raise an error if the request is formatted in an unknown format" do
       handler.stubs(:content_type_header).returns "unknown format"
       lambda { handler.request_format(request) }.should raise_error
     end
 
     it "should still find the correct format if content type contains charset information" do
       request = Puppet::Network::HTTP::Request.new({ 'content-type' => "text/plain; charset=UTF-8" },
                                                    {}, 'GET', '/', nil)
       request.format.should == "s"
     end
 
     it "should deserialize YAML parameters" do
       params = {'my_param' => [1,2,3].to_yaml}
 
       decoded_params = handler.send(:decode_params, params)
 
       decoded_params.should == {:my_param => [1,2,3]}
     end
 
     it "should ignore tags on YAML parameters" do
       params = {'my_param' => "--- !ruby/object:Array {}"}
 
       decoded_params = handler.send(:decode_params, params)
 
       decoded_params[:my_param].should be_a(Hash)
     end
   end
 
 
   describe "when resolving node" do
     it "should use a look-up from the ip address" do
       Resolv.expects(:getname).with("1.2.3.4").returns("host.domain.com")
 
       handler.resolve_node(:ip => "1.2.3.4")
     end
 
     it "should return the look-up result" do
       Resolv.stubs(:getname).with("1.2.3.4").returns("host.domain.com")
 
       handler.resolve_node(:ip => "1.2.3.4").should == "host.domain.com"
     end
 
     it "should return the ip address if resolving fails" do
       Resolv.stubs(:getname).with("1.2.3.4").raises(RuntimeError, "no such host")
 
       handler.resolve_node(:ip => "1.2.3.4").should == "1.2.3.4"
     end
   end
 
   class TestingHandler
     include Puppet::Network::HTTP::Handler
 
     def initialize(* routes)
       register(routes)
     end
 
     def set_content_type(response, format)
      response[:content_type_header] = format
     end
 
     def set_response(response, body, status = 200)
       response[:body] = body
       response[:status] = status
     end
 
     def http_method(request)
       request[:http_method]
     end
 
     def path(request)
       request[:path]
     end
 
     def params(request)
       request[:params]
     end
 
     def client_cert(request)
       request[:client_cert]
     end
 
     def body(request)
       request[:body]
     end
 
     def headers(request)
       request[:headers] || {}
     end
   end
 
   class HandlerTestProfiler
     def start(metric, description)
     end
 
     def finish(context, metric, description)
     end
 
     def shutdown()
     end
   end
 end
diff --git a/spec/unit/network/http/rack/rest_spec.rb b/spec/unit/network/http/rack/rest_spec.rb
index 165b6ceb9..c35b789a2 100755
--- a/spec/unit/network/http/rack/rest_spec.rb
+++ b/spec/unit/network/http/rack/rest_spec.rb
@@ -1,316 +1,316 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
 require 'puppet/network/http/rack' if Puppet.features.rack?
 require 'puppet/network/http/rack/rest'
 
 describe "Puppet::Network::HTTP::RackREST", :if => Puppet.features.rack? do
   it "should include the Puppet::Network::HTTP::Handler module" do
     Puppet::Network::HTTP::RackREST.ancestors.should be_include(Puppet::Network::HTTP::Handler)
   end
 
   describe "when serving a request" do
     before :all do
       @model_class = stub('indirected model class')
       Puppet::Indirector::Indirection.stubs(:model).with(:foo).returns(@model_class)
-      @handler = Puppet::Network::HTTP::RackREST.new(:handler => :foo)
     end
 
     before :each do
       @response = Rack::Response.new
+      @handler = Puppet::Network::HTTP::RackREST.new(:handler => :foo)
     end
 
     def mk_req(uri, opts = {})
       env = Rack::MockRequest.env_for(uri, opts)
       Rack::Request.new(env)
     end
 
     let(:minimal_certificate) do
         cert = OpenSSL::X509::Certificate.new
         cert.version = 2
         cert.serial = 0
         cert.not_before = Time.now
         cert.not_after = Time.now + 3600
         cert.public_key = OpenSSL::PKey::RSA.new(512)
         cert.subject = OpenSSL::X509::Name.parse("/CN=testing")
         cert
     end
 
     describe "#headers" do
       it "should return the headers (parsed from env with prefix 'HTTP_')" do
         req = mk_req('/', {'HTTP_Accept' => 'myaccept',
                            'HTTP_X_Custom_Header' => 'mycustom',
                            'NOT_HTTP_foo' => 'not an http header'})
         @handler.headers(req).should == {"accept" => 'myaccept',
                                          "x-custom-header" => 'mycustom',
                                          "content-type" => nil }
       end
     end
 
     describe "and using the HTTP Handler interface" do
       it "should return the CONTENT_TYPE parameter as the content type header" do
         req = mk_req('/', 'CONTENT_TYPE' => 'mycontent')
         @handler.headers(req)['content-type'].should == "mycontent"
       end
 
       it "should use the REQUEST_METHOD as the http method" do
         req = mk_req('/', :method => 'MYMETHOD')
         @handler.http_method(req).should == "MYMETHOD"
       end
 
       it "should return the request path as the path" do
         req = mk_req('/foo/bar')
         @handler.path(req).should == "/foo/bar"
       end
 
       it "should return the request body as the body" do
         req = mk_req('/foo/bar', :input => 'mybody')
         @handler.body(req).should == "mybody"
       end
 
       it "should return the an Puppet::SSL::Certificate instance as the client_cert" do
         req = mk_req('/foo/bar', 'SSL_CLIENT_CERT' => minimal_certificate.to_pem)
         expect(@handler.client_cert(req).content.to_pem).to eq(minimal_certificate.to_pem)
       end
 
       it "returns nil when SSL_CLIENT_CERT is empty" do
         req = mk_req('/foo/bar', 'SSL_CLIENT_CERT' => '')
 
         @handler.client_cert(req).should be_nil
       end
 
       it "should set the response's content-type header when setting the content type" do
         @header = mock 'header'
         @response.expects(:header).returns @header
         @header.expects(:[]=).with('Content-Type', "mytype")
 
         @handler.set_content_type(@response, "mytype")
       end
 
       it "should set the status and write the body when setting the response for a request" do
         @response.expects(:status=).with(400)
         @response.expects(:write).with("mybody")
 
         @handler.set_response(@response, "mybody", 400)
       end
 
       describe "when result is a File" do
         before :each do
           stat = stub 'stat', :size => 100
           @file = stub 'file', :stat => stat, :path => "/tmp/path"
           @file.stubs(:is_a?).with(File).returns(true)
         end
 
         it "should set the Content-Length header as a string" do
           @response.expects(:[]=).with("Content-Length", '100')
 
           @handler.set_response(@response, @file, 200)
         end
 
         it "should return a RackFile adapter as body" do
           @response.expects(:body=).with { |val| val.is_a?(Puppet::Network::HTTP::RackREST::RackFile) }
 
           @handler.set_response(@response, @file, 200)
         end
       end
 
       it "should ensure the body has been read on success" do
         req = mk_req('/production/report/foo', :method => 'PUT')
         req.body.expects(:read).at_least_once
 
         Puppet::Transaction::Report.stubs(:save)
 
         @handler.process(req, @response)
       end
 
       it "should ensure the body has been partially read on failure" do
         req = mk_req('/production/report/foo')
         req.body.expects(:read).with(1)
 
         @handler.stubs(:headers).raises(Exception)
 
         @handler.process(req, @response)
       end
     end
 
     describe "and determining the request parameters" do
       it "should include the HTTP request parameters, with the keys as symbols" do
         req = mk_req('/?foo=baz&bar=xyzzy')
         result = @handler.params(req)
         result[:foo].should == "baz"
         result[:bar].should == "xyzzy"
       end
 
       it "should return multi-values params as an array of the values" do
         req = mk_req('/?foo=baz&foo=xyzzy')
         result = @handler.params(req)
         result[:foo].should == ["baz", "xyzzy"]
       end
 
       it "should return parameters from the POST body" do
         req = mk_req("/", :method => 'POST', :input => 'foo=baz&bar=xyzzy')
         result = @handler.params(req)
         result[:foo].should == "baz"
         result[:bar].should == "xyzzy"
       end
 
       it "should not return multi-valued params in a POST body as an array of values" do
         req = mk_req("/", :method => 'POST', :input => 'foo=baz&foo=xyzzy')
         result = @handler.params(req)
         result[:foo].should be_one_of("baz", "xyzzy")
       end
 
       it "should CGI-decode the HTTP parameters" do
         encoding = CGI.escape("foo bar")
         req = mk_req("/?foo=#{encoding}")
         result = @handler.params(req)
         result[:foo].should == "foo bar"
       end
 
       it "should convert the string 'true' to the boolean" do
         req = mk_req("/?foo=true")
         result = @handler.params(req)
         result[:foo].should be_true
       end
 
       it "should convert the string 'false' to the boolean" do
         req = mk_req("/?foo=false")
         result = @handler.params(req)
         result[:foo].should be_false
       end
 
       it "should convert integer arguments to Integers" do
         req = mk_req("/?foo=15")
         result = @handler.params(req)
         result[:foo].should == 15
       end
 
       it "should convert floating point arguments to Floats" do
         req = mk_req("/?foo=1.5")
         result = @handler.params(req)
         result[:foo].should == 1.5
       end
 
       it "should YAML-load and CGI-decode values that are YAML-encoded" do
         escaping = CGI.escape(YAML.dump(%w{one two}))
         req = mk_req("/?foo=#{escaping}")
         result = @handler.params(req)
         result[:foo].should == %w{one two}
       end
 
       it "should not allow the client to set the node via the query string" do
         req = mk_req("/?node=foo")
         @handler.params(req)[:node].should be_nil
       end
 
       it "should not allow the client to set the IP address via the query string" do
         req = mk_req("/?ip=foo")
         @handler.params(req)[:ip].should be_nil
       end
 
       it "should pass the client's ip address to model find" do
         req = mk_req("/", 'REMOTE_ADDR' => 'ipaddress')
         @handler.params(req)[:ip].should == "ipaddress"
       end
 
       it "should set 'authenticated' to false if no certificate is present" do
         req = mk_req('/')
         @handler.params(req)[:authenticated].should be_false
       end
     end
 
     describe "with pre-validated certificates" do
       it "should retrieve the hostname by finding the CN given in :ssl_client_header, in the format returned by Apache (RFC2253)" do
         Puppet[:ssl_client_header] = "myheader"
         req = mk_req('/', "myheader" => "O=Foo\\, Inc,CN=host.domain.com")
         @handler.params(req)[:node].should == "host.domain.com"
       end
 
       it "should retrieve the hostname by finding the CN given in :ssl_client_header, in the format returned by nginx" do
         Puppet[:ssl_client_header] = "myheader"
         req = mk_req('/', "myheader" => "/CN=host.domain.com")
         @handler.params(req)[:node].should == "host.domain.com"
       end
 
       it "should retrieve the hostname by finding the CN given in :ssl_client_header, ignoring other fields" do
         Puppet[:ssl_client_header] = "myheader"
         req = mk_req('/', "myheader" => 'ST=Denial,CN=host.domain.com,O=Domain\\, Inc.')
         @handler.params(req)[:node].should == "host.domain.com"
       end
 
       it "should use the :ssl_client_header to determine the parameter for checking whether the host certificate is valid" do
         Puppet[:ssl_client_header] = "certheader"
         Puppet[:ssl_client_verify_header] = "myheader"
         req = mk_req('/', "myheader" => "SUCCESS", "certheader" => "CN=host.domain.com")
         @handler.params(req)[:authenticated].should be_true
       end
 
       it "should consider the host unauthenticated if the validity parameter does not contain 'SUCCESS'" do
         Puppet[:ssl_client_header] = "certheader"
         Puppet[:ssl_client_verify_header] = "myheader"
         req = mk_req('/', "myheader" => "whatever", "certheader" => "CN=host.domain.com")
         @handler.params(req)[:authenticated].should be_false
       end
 
       it "should consider the host unauthenticated if no certificate information is present" do
         Puppet[:ssl_client_header] = "certheader"
         Puppet[:ssl_client_verify_header] = "myheader"
         req = mk_req('/', "myheader" => nil, "certheader" => "CN=host.domain.com")
         @handler.params(req)[:authenticated].should be_false
       end
 
       it "should resolve the node name with an ip address look-up if no certificate is present" do
         Puppet[:ssl_client_header] = "myheader"
         req = mk_req('/', "myheader" => nil)
         @handler.expects(:resolve_node).returns("host.domain.com")
         @handler.params(req)[:node].should == "host.domain.com"
       end
 
       it "should resolve the node name with an ip address look-up if a certificate without a CN is present" do
         Puppet[:ssl_client_header] = "myheader"
         req = mk_req('/', "myheader" => "O=no CN")
         @handler.expects(:resolve_node).returns("host.domain.com")
         @handler.params(req)[:node].should == "host.domain.com"
       end
 
       it "should not allow authentication via the verify header if there is no CN available" do
         Puppet[:ssl_client_header] = "dn_header"
         Puppet[:ssl_client_verify_header] = "verify_header"
         req = mk_req('/', "dn_header" => "O=no CN", "verify_header" => 'SUCCESS')
 
         @handler.expects(:resolve_node).returns("host.domain.com")
 
         @handler.params(req)[:authenticated].should be_false
       end
     end
   end
 end
 
 describe Puppet::Network::HTTP::RackREST::RackFile do
   before(:each) do
     stat = stub 'stat', :size => 100
     @file = stub 'file', :stat => stat, :path => "/tmp/path"
     @rackfile = Puppet::Network::HTTP::RackREST::RackFile.new(@file)
   end
 
   it "should have an each method" do
     @rackfile.should be_respond_to(:each)
   end
 
   it "should yield file chunks by chunks" do
     @file.expects(:read).times(3).with(8192).returns("1", "2", nil)
     i = 1
     @rackfile.each do |chunk|
       chunk.to_i.should == i
       i += 1
     end
   end
 
   it "should have a close method" do
     @rackfile.should be_respond_to(:close)
   end
 
   it "should delegate close to File close" do
     @file.expects(:close)
     @rackfile.close
   end
 end