diff --git a/lib/puppet/ssl/host.rb b/lib/puppet/ssl/host.rb
index da6c41bd9..f4ac6a54a 100644
--- a/lib/puppet/ssl/host.rb
+++ b/lib/puppet/ssl/host.rb
@@ -1,275 +1,277 @@
 require 'puppet/ssl'
 require 'puppet/ssl/key'
 require 'puppet/ssl/certificate'
 require 'puppet/ssl/certificate_request'
 require 'puppet/ssl/certificate_revocation_list'
 require 'puppet/util/cacher'
 
 # The class that manages all aspects of our SSL certificates --
 # private keys, public keys, requests, etc.
 class Puppet::SSL::Host
   # Yay, ruby's strange constant lookups.
   Key = Puppet::SSL::Key
   CA_NAME = Puppet::SSL::CA_NAME
   Certificate = Puppet::SSL::Certificate
   CertificateRequest = Puppet::SSL::CertificateRequest
   CertificateRevocationList = Puppet::SSL::CertificateRevocationList
 
   attr_reader :name
   attr_accessor :ca
 
   attr_writer :key, :certificate, :certificate_request
 
   class << self
     include Puppet::Util::Cacher
 
     cached_attr(:localhost) do
       result = new
       result.generate unless result.certificate
       result.key # Make sure it's read in
       result
     end
   end
 
   # This is the constant that people will use to mark that a given host is
   # a certificate authority.
   def self.ca_name
     CA_NAME
   end
 
   class << self
     attr_reader :ca_location
   end
 
   # Configure how our various classes interact with their various terminuses.
   def self.configure_indirection(terminus, cache = nil)
     Certificate.terminus_class = terminus
     CertificateRequest.terminus_class = terminus
     CertificateRevocationList.terminus_class = terminus
 
     if cache
       # This is weird; we don't actually cache our keys, we
       # use what would otherwise be the cache as our normal
       # terminus.
       Key.terminus_class = cache
     else
       Key.terminus_class = terminus
     end
 
     if cache
       Certificate.cache_class = cache
       CertificateRequest.cache_class = cache
       CertificateRevocationList.cache_class = cache
     else
       # Make sure we have no cache configured.  puppet master
       # switches the configurations around a bit, so it's important
       # that we specify the configs for absolutely everything, every
       # time.
       Certificate.cache_class = nil
       CertificateRequest.cache_class = nil
       CertificateRevocationList.cache_class = nil
     end
   end
 
   CA_MODES = {
     # Our ca is local, so we use it as the ultimate source of information
     # And we cache files locally.
     :local => [:ca, :file],
     # We're a remote CA client.
     :remote => [:rest, :file],
     # We are the CA, so we don't have read/write access to the normal certificates.
     :only => [:ca],
     # We have no CA, so we just look in the local file store.
     :none => [:file]
   }
 
   # Specify how we expect to interact with our certificate authority.
   def self.ca_location=(mode)
     raise ArgumentError, "CA Mode can only be #{CA_MODES.collect { |m| m.to_s }.join(", ")}" unless CA_MODES.include?(mode)
 
     @ca_location = mode
 
     configure_indirection(*CA_MODES[@ca_location])
   end
 
   # Remove all traces of a given host
   def self.destroy(name)
     [Key, Certificate, CertificateRequest].collect { |part| part.destroy(name) }.any? { |x| x }
   end
 
   # Search for more than one host, optionally only specifying
   # an interest in hosts with a given file type.
   # This just allows our non-indirected class to have one of
   # indirection methods.
   def self.search(options = {})
     classlist = [options[:for] || [Key, CertificateRequest, Certificate]].flatten
 
     # Collect the results from each class, flatten them, collect all of the names, make the name list unique,
     # then create a Host instance for each one.
     classlist.collect { |klass| klass.search }.flatten.collect { |r| r.name }.uniq.collect do |name|
       new(name)
     end
   end
 
   # Is this a ca host, meaning that all of its files go in the CA location?
   def ca?
     ca
   end
 
   def key
     @key ||= Key.find(name)
   end
 
   # This is the private key; we can create it from scratch
   # with no inputs.
   def generate_key
     @key = Key.new(name)
     @key.generate
     begin
       @key.save
     rescue
       @key = nil
       raise
     end
     true
   end
 
   def certificate_request
     @certificate_request ||= CertificateRequest.find(name)
   end
 
   def this_csr_is_for_the_current_host
     name == Puppet[:certname].downcase
   end
 
   # Our certificate request requires the key but that's all.
   def generate_certificate_request(options = {})
     generate_key unless key
 
     # If this is for the current machine...
     if this_csr_is_for_the_current_host
       # ...add our configured dns_alt_names
       if Puppet[:dns_alt_names] and Puppet[:dns_alt_names] != ''
         options[:dns_alt_names] ||= Puppet[:dns_alt_names]
+      elsif Puppet::SSL::CertificateAuthority.ca? and fqdn = Facter.value(:fqdn) and domain = Facter.value(:domain)
+        options[:dns_alt_names] = "puppet, #{fqdn}, puppet.#{domain}"
       end
     end
 
     @certificate_request = CertificateRequest.new(name)
     @certificate_request.generate(key.content, options)
     begin
       @certificate_request.save
     rescue
       @certificate_request = nil
       raise
     end
 
     true
   end
 
   def certificate
     unless @certificate
       generate_key unless key
 
       # get the CA cert first, since it's required for the normal cert
       # to be of any use.
       return nil unless Certificate.find("ca") unless ca?
       return nil unless @certificate = Certificate.find(name)
 
       unless certificate_matches_key?
         raise Puppet::Error, "Retrieved certificate does not match private key; please remove certificate from server and regenerate it with the current key"
       end
     end
     @certificate
   end
 
   def certificate_matches_key?
     return false unless key
     return false unless certificate
 
     certificate.content.check_private_key(key.content)
   end
 
   # Generate all necessary parts of our ssl host.
   def generate
     generate_key unless key
     generate_certificate_request unless certificate_request
 
     # If we can get a CA instance, then we're a valid CA, and we
     # should use it to sign our request; else, just try to read
     # the cert.
     if ! certificate and ca = Puppet::SSL::CertificateAuthority.instance
       ca.sign(self.name, true)
     end
   end
 
   def initialize(name = nil)
     @name = (name || Puppet[:certname]).downcase
     @key = @certificate = @certificate_request = nil
     @ca = (name == self.class.ca_name)
   end
 
   # Extract the public key from the private key.
   def public_key
     key.content.public_key
   end
 
   # Create/return a store that uses our SSL info to validate
   # connections.
   def ssl_store(purpose = OpenSSL::X509::PURPOSE_ANY)
     unless @ssl_store
       @ssl_store = OpenSSL::X509::Store.new
       @ssl_store.purpose = purpose
 
       # Use the file path here, because we don't want to cause
       # a lookup in the middle of setting our ssl connection.
       @ssl_store.add_file(Puppet[:localcacert])
 
       # If there's a CRL, add it to our store.
       if crl = Puppet::SSL::CertificateRevocationList.find(CA_NAME)
         @ssl_store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK if Puppet.settings[:certificate_revocation]
         @ssl_store.add_crl(crl.content)
       end
       return @ssl_store
     end
     @ssl_store
   end
 
   # Attempt to retrieve a cert, if we don't already have one.
   def wait_for_cert(time)
     begin
       return if certificate
       generate
       return if certificate
     rescue SystemExit,NoMemoryError
       raise
     rescue Exception => detail
       puts detail.backtrace if Puppet[:trace]
       Puppet.err "Could not request certificate: #{detail}"
       if time < 1
         puts "Exiting; failed to retrieve certificate and waitforcert is disabled"
         exit(1)
       else
         sleep(time)
       end
       retry
     end
 
     if time < 1
       puts "Exiting; no certificate found and waitforcert is disabled"
       exit(1)
     end
 
     while true
       sleep time
       begin
         break if certificate
         Puppet.notice "Did not receive certificate"
       rescue StandardError => detail
         puts detail.backtrace if Puppet[:trace]
         Puppet.err "Could not request certificate: #{detail}"
       end
     end
   end
 end
 
 require 'puppet/ssl/certificate_authority'
diff --git a/spec/unit/ssl/host_spec.rb b/spec/unit/ssl/host_spec.rb
index b4f703bae..6b4a066b5 100755
--- a/spec/unit/ssl/host_spec.rb
+++ b/spec/unit/ssl/host_spec.rb
@@ -1,749 +1,798 @@
 #!/usr/bin/env ruby
 
 require File.dirname(__FILE__) + '/../../spec_helper'
 
 require 'puppet/ssl/host'
 
 describe Puppet::SSL::Host do
   include PuppetSpec::Files
 
   before do
     @class = Puppet::SSL::Host
     @host = @class.new("myname")
   end
 
   after do
     # Cleaned out any cached localhost instance.
     Puppet::Util::Cacher.expire
   end
 
   it "should use any provided name as its name" do
     @host.name.should == "myname"
   end
 
   it "should retrieve its public key from its private key" do
     realkey = mock 'realkey'
     key = stub 'key', :content => realkey
     Puppet::SSL::Key.stubs(:find).returns(key)
     pubkey = mock 'public_key'
     realkey.expects(:public_key).returns pubkey
 
     @host.public_key.should equal(pubkey)
   end
 
   it "should default to being a non-ca host" do
     @host.ca?.should be_false
   end
 
   it "should be a ca host if its name matches the CA_NAME" do
     Puppet::SSL::Host.stubs(:ca_name).returns "yayca"
     Puppet::SSL::Host.new("yayca").should be_ca
   end
 
   it "should have a method for determining the CA location" do
     Puppet::SSL::Host.should respond_to(:ca_location)
   end
 
   it "should have a method for specifying the CA location" do
     Puppet::SSL::Host.should respond_to(:ca_location=)
   end
 
   it "should have a method for retrieving the default ssl host" do
     Puppet::SSL::Host.should respond_to(:ca_location=)
   end
 
   it "should have a method for producing an instance to manage the local host's keys" do
     Puppet::SSL::Host.should respond_to(:localhost)
   end
 
   it "should generate the certificate for the localhost instance if no certificate is available" do
     host = stub 'host', :key => nil
     Puppet::SSL::Host.expects(:new).returns host
 
     host.expects(:certificate).returns nil
     host.expects(:generate)
 
     Puppet::SSL::Host.localhost.should equal(host)
   end
 
   it "should create a localhost cert if no cert is available and it is a CA with autosign and it is using DNS alt names" do
     Puppet[:autosign] = true
     Puppet[:confdir] = tmpdir('conf')
     Puppet[:dns_alt_names] = "foo,bar,baz"
     ca = Puppet::SSL::CertificateAuthority.new
     Puppet::SSL::CertificateAuthority.stubs(:instance).returns ca
 
     localhost = Puppet::SSL::Host.localhost
     cert = localhost.certificate
 
     cert.should be_a(Puppet::SSL::Certificate)
     cert.subject_alt_names.should =~ %W[DNS:#{Puppet[:certname]} DNS:foo DNS:bar DNS:baz]
   end
 
   context "with dns_alt_names" do
     before :each do
-      Puppet[:dns_alt_names] = 'one, two'
-
       @key = stub('key content')
       key = stub('key', :generate => true, :save => true, :content => @key)
       Puppet::SSL::Key.stubs(:new).returns key
 
       @cr = stub('certificate request', :save => true)
       Puppet::SSL::CertificateRequest.stubs(:new).returns @cr
     end
 
-    it "should not include subjectAltName if not the local node" do
-      @cr.expects(:generate).with(@key, {})
+    describe "explicitly specified" do
+      before :each do
+        Puppet[:dns_alt_names] = 'one, two'
+      end
+
+      it "should not include subjectAltName if not the local node" do
+        @cr.expects(:generate).with(@key, {})
 
-      Puppet::SSL::Host.new('not-the-' + Puppet[:certname]).generate
+        Puppet::SSL::Host.new('not-the-' + Puppet[:certname]).generate
+      end
+
+      it "should include subjectAltName if I am a CA" do
+        @cr.expects(:generate).
+          with(@key, { :dns_alt_names => Puppet[:dns_alt_names] })
+
+        Puppet::SSL::Host.localhost
+      end
     end
 
-    it "should include subjectAltName if I am a CA" do
-      @cr.expects(:generate).
-        with(@key, { :dns_alt_names => Puppet[:dns_alt_names] })
+    describe "implicitly defaulted" do
+      let(:ca) { stub('ca', :sign => nil) }
 
-      Puppet::SSL::Host.localhost
+      before :each do
+        Puppet[:dns_alt_names] = ''
+
+        Puppet::SSL::CertificateAuthority.stubs(:instance).returns ca
+      end
+
+      it "should not include defaults if we're not the CA" do
+        Puppet::SSL::CertificateAuthority.stubs(:ca?).returns false
+
+        @cr.expects(:generate).with(@key, {})
+
+        Puppet::SSL::Host.localhost
+      end
+
+      it "should not include defaults if not the local node" do
+        Puppet::SSL::CertificateAuthority.stubs(:ca?).returns true
+
+        @cr.expects(:generate).with(@key, {})
+
+        Puppet::SSL::Host.new('not-the-' + Puppet[:certname]).generate
+      end
+
+      it "should not include defaults if we can't resolve our fqdn" do
+        Puppet::SSL::CertificateAuthority.stubs(:ca?).returns true
+        Facter.stubs(:value).with(:fqdn).returns nil
+
+        @cr.expects(:generate).with(@key, {})
+
+        Puppet::SSL::Host.localhost
+      end
+
+      it "should provide defaults if we're bootstrapping the local master" do
+        Puppet::SSL::CertificateAuthority.stubs(:ca?).returns true
+        Facter.stubs(:value).with(:fqdn).returns 'web.foo.com'
+        Facter.stubs(:value).with(:domain).returns 'foo.com'
+
+        @cr.expects(:generate).with(@key, {:dns_alt_names => "puppet, web.foo.com, puppet.foo.com"})
+
+        Puppet::SSL::Host.localhost
+      end
     end
   end
 
   it "should always read the key for the localhost instance in from disk" do
     host = stub 'host', :certificate => "eh"
     Puppet::SSL::Host.expects(:new).returns host
 
     host.expects(:key)
 
     Puppet::SSL::Host.localhost
   end
 
   it "should cache the localhost instance" do
     host = stub 'host', :certificate => "eh", :key => 'foo'
     Puppet::SSL::Host.expects(:new).once.returns host
 
     Puppet::SSL::Host.localhost.should == Puppet::SSL::Host.localhost
   end
 
   it "should be able to expire the cached instance" do
     one = stub 'host1', :certificate => "eh", :key => 'foo'
     two = stub 'host2', :certificate => "eh", :key => 'foo'
     Puppet::SSL::Host.expects(:new).times(2).returns(one).then.returns(two)
 
     Puppet::SSL::Host.localhost.should equal(one)
     Puppet::Util::Cacher.expire
     Puppet::SSL::Host.localhost.should equal(two)
   end
 
   it "should be able to verify its certificate matches its key" do
     Puppet::SSL::Host.new("foo").should respond_to(:certificate_matches_key?)
   end
 
   it "should consider the certificate invalid if it cannot find a key" do
     host = Puppet::SSL::Host.new("foo")
     host.expects(:key).returns nil
 
     host.should_not be_certificate_matches_key
   end
 
   it "should consider the certificate invalid if it cannot find a certificate" do
     host = Puppet::SSL::Host.new("foo")
     host.expects(:key).returns mock("key")
     host.expects(:certificate).returns nil
 
     host.should_not be_certificate_matches_key
   end
 
   it "should consider the certificate invalid if the SSL certificate's key verification fails" do
     host = Puppet::SSL::Host.new("foo")
 
     key = mock 'key', :content => "private_key"
     sslcert = mock 'sslcert'
     certificate = mock 'cert', :content => sslcert
 
     host.stubs(:key).returns key
     host.stubs(:certificate).returns certificate
 
     sslcert.expects(:check_private_key).with("private_key").returns false
 
     host.should_not be_certificate_matches_key
   end
 
   it "should consider the certificate valid if the SSL certificate's key verification succeeds" do
     host = Puppet::SSL::Host.new("foo")
 
     key = mock 'key', :content => "private_key"
     sslcert = mock 'sslcert'
     certificate = mock 'cert', :content => sslcert
 
     host.stubs(:key).returns key
     host.stubs(:certificate).returns certificate
 
     sslcert.expects(:check_private_key).with("private_key").returns true
 
     host.should be_certificate_matches_key
   end
 
   describe "when specifying the CA location" do
     before do
       [Puppet::SSL::Key, Puppet::SSL::Certificate, Puppet::SSL::CertificateRequest, Puppet::SSL::CertificateRevocationList].each do |klass|
         klass.stubs(:terminus_class=)
         klass.stubs(:cache_class=)
       end
     end
 
     it "should support the location ':local'" do
       lambda { Puppet::SSL::Host.ca_location = :local }.should_not raise_error
     end
 
     it "should support the location ':remote'" do
       lambda { Puppet::SSL::Host.ca_location = :remote }.should_not raise_error
     end
 
     it "should support the location ':none'" do
       lambda { Puppet::SSL::Host.ca_location = :none }.should_not raise_error
     end
 
     it "should support the location ':only'" do
       lambda { Puppet::SSL::Host.ca_location = :only }.should_not raise_error
     end
 
     it "should not support other modes" do
       lambda { Puppet::SSL::Host.ca_location = :whatever }.should raise_error(ArgumentError)
     end
 
     describe "as 'local'" do
       it "should set the cache class for Certificate, CertificateRevocationList, and CertificateRequest as :file" do
         Puppet::SSL::Certificate.expects(:cache_class=).with :file
         Puppet::SSL::CertificateRequest.expects(:cache_class=).with :file
         Puppet::SSL::CertificateRevocationList.expects(:cache_class=).with :file
 
         Puppet::SSL::Host.ca_location = :local
       end
 
       it "should set the terminus class for Key as :file" do
         Puppet::SSL::Key.expects(:terminus_class=).with :file
 
         Puppet::SSL::Host.ca_location = :local
       end
 
       it "should set the terminus class for Certificate, CertificateRevocationList, and CertificateRequest as :ca" do
         Puppet::SSL::Certificate.expects(:terminus_class=).with :ca
         Puppet::SSL::CertificateRequest.expects(:terminus_class=).with :ca
         Puppet::SSL::CertificateRevocationList.expects(:terminus_class=).with :ca
 
         Puppet::SSL::Host.ca_location = :local
       end
     end
 
     describe "as 'remote'" do
       it "should set the cache class for Certificate, CertificateRevocationList, and CertificateRequest as :file" do
         Puppet::SSL::Certificate.expects(:cache_class=).with :file
         Puppet::SSL::CertificateRequest.expects(:cache_class=).with :file
         Puppet::SSL::CertificateRevocationList.expects(:cache_class=).with :file
 
         Puppet::SSL::Host.ca_location = :remote
       end
 
       it "should set the terminus class for Key as :file" do
         Puppet::SSL::Key.expects(:terminus_class=).with :file
 
         Puppet::SSL::Host.ca_location = :remote
       end
 
       it "should set the terminus class for Certificate, CertificateRevocationList, and CertificateRequest as :rest" do
         Puppet::SSL::Certificate.expects(:terminus_class=).with :rest
         Puppet::SSL::CertificateRequest.expects(:terminus_class=).with :rest
         Puppet::SSL::CertificateRevocationList.expects(:terminus_class=).with :rest
 
         Puppet::SSL::Host.ca_location = :remote
       end
     end
 
     describe "as 'only'" do
       it "should set the terminus class for Key, Certificate, CertificateRevocationList, and CertificateRequest as :ca" do
         Puppet::SSL::Key.expects(:terminus_class=).with :ca
         Puppet::SSL::Certificate.expects(:terminus_class=).with :ca
         Puppet::SSL::CertificateRequest.expects(:terminus_class=).with :ca
         Puppet::SSL::CertificateRevocationList.expects(:terminus_class=).with :ca
 
         Puppet::SSL::Host.ca_location = :only
       end
 
       it "should reset the cache class for Certificate, CertificateRevocationList, and CertificateRequest to nil" do
         Puppet::SSL::Certificate.expects(:cache_class=).with nil
         Puppet::SSL::CertificateRequest.expects(:cache_class=).with nil
         Puppet::SSL::CertificateRevocationList.expects(:cache_class=).with nil
 
         Puppet::SSL::Host.ca_location = :only
       end
     end
 
     describe "as 'none'" do
       it "should set the terminus class for Key, Certificate, CertificateRevocationList, and CertificateRequest as :file" do
         Puppet::SSL::Key.expects(:terminus_class=).with :file
         Puppet::SSL::Certificate.expects(:terminus_class=).with :file
         Puppet::SSL::CertificateRequest.expects(:terminus_class=).with :file
         Puppet::SSL::CertificateRevocationList.expects(:terminus_class=).with :file
 
         Puppet::SSL::Host.ca_location = :none
       end
     end
   end
 
   it "should have a class method for destroying all files related to a given host" do
     Puppet::SSL::Host.should respond_to(:destroy)
   end
 
   describe "when destroying a host's SSL files" do
     before do
       Puppet::SSL::Key.stubs(:destroy).returns false
       Puppet::SSL::Certificate.stubs(:destroy).returns false
       Puppet::SSL::CertificateRequest.stubs(:destroy).returns false
     end
 
     it "should destroy its certificate, certificate request, and key" do
       Puppet::SSL::Key.expects(:destroy).with("myhost")
       Puppet::SSL::Certificate.expects(:destroy).with("myhost")
       Puppet::SSL::CertificateRequest.expects(:destroy).with("myhost")
 
       Puppet::SSL::Host.destroy("myhost")
     end
 
     it "should return true if any of the classes returned true" do
       Puppet::SSL::Certificate.expects(:destroy).with("myhost").returns true
 
       Puppet::SSL::Host.destroy("myhost").should be_true
     end
 
     it "should return false if none of the classes returned true" do
       Puppet::SSL::Host.destroy("myhost").should be_false
     end
   end
 
   describe "when initializing" do
     it "should default its name to the :certname setting" do
       Puppet.settings.expects(:value).with(:certname).returns "myname"
 
       Puppet::SSL::Host.new.name.should == "myname"
     end
 
     it "should downcase a passed in name" do
       Puppet::SSL::Host.new("Host.Domain.Com").name.should == "host.domain.com"
     end
 
     it "should downcase the certname if it's used" do
       Puppet.settings.expects(:value).with(:certname).returns "Host.Domain.Com"
       Puppet::SSL::Host.new.name.should == "host.domain.com"
     end
 
     it "should indicate that it is a CA host if its name matches the ca_name constant" do
       Puppet::SSL::Host.stubs(:ca_name).returns "myca"
       Puppet::SSL::Host.new("myca").should be_ca
     end
   end
 
   describe "when managing its private key" do
     before do
       @realkey = "mykey"
       @key = stub 'key', :content => @realkey
     end
 
     it "should return nil if the key is not set and cannot be found" do
       Puppet::SSL::Key.expects(:find).with("myname").returns(nil)
       @host.key.should be_nil
     end
 
     it "should find the key in the Key class and return the Puppet instance" do
       Puppet::SSL::Key.expects(:find).with("myname").returns(@key)
       @host.key.should equal(@key)
     end
 
     it "should be able to generate and save a new key" do
       Puppet::SSL::Key.expects(:new).with("myname").returns(@key)
 
       @key.expects(:generate)
       @key.expects(:save)
 
       @host.generate_key.should be_true
       @host.key.should equal(@key)
     end
 
     it "should not retain keys that could not be saved" do
       Puppet::SSL::Key.expects(:new).with("myname").returns(@key)
 
       @key.stubs(:generate)
       @key.expects(:save).raises "eh"
 
       lambda { @host.generate_key }.should raise_error
       @host.key.should be_nil
     end
 
     it "should return any previously found key without requerying" do
       Puppet::SSL::Key.expects(:find).with("myname").returns(@key).once
       @host.key.should equal(@key)
       @host.key.should equal(@key)
     end
   end
 
   describe "when managing its certificate request" do
     before do
       @realrequest = "real request"
       @request = stub 'request', :content => @realrequest
     end
 
     it "should return nil if the key is not set and cannot be found" do
       Puppet::SSL::CertificateRequest.expects(:find).with("myname").returns(nil)
       @host.certificate_request.should be_nil
     end
 
     it "should find the request in the Key class and return it and return the Puppet SSL request" do
       Puppet::SSL::CertificateRequest.expects(:find).with("myname").returns @request
 
       @host.certificate_request.should equal(@request)
     end
 
     it "should generate a new key when generating the cert request if no key exists" do
       Puppet::SSL::CertificateRequest.expects(:new).with("myname").returns @request
 
       key = stub 'key', :public_key => mock("public_key"), :content => "mycontent"
 
       @host.expects(:key).times(2).returns(nil).then.returns(key)
       @host.expects(:generate_key).returns(key)
 
       @request.stubs(:generate)
       @request.stubs(:save)
 
       @host.generate_certificate_request
     end
 
     it "should be able to generate and save a new request using the private key" do
       Puppet::SSL::CertificateRequest.expects(:new).with("myname").returns @request
 
       key = stub 'key', :public_key => mock("public_key"), :content => "mycontent"
       @host.stubs(:key).returns(key)
       @request.expects(:generate).with("mycontent", {})
       @request.expects(:save)
 
       @host.generate_certificate_request.should be_true
       @host.certificate_request.should equal(@request)
     end
 
     it "should return any previously found request without requerying" do
       Puppet::SSL::CertificateRequest.expects(:find).with("myname").returns(@request).once
 
       @host.certificate_request.should equal(@request)
       @host.certificate_request.should equal(@request)
     end
 
     it "should not keep its certificate request in memory if the request cannot be saved" do
       Puppet::SSL::CertificateRequest.expects(:new).with("myname").returns @request
 
       key = stub 'key', :public_key => mock("public_key"), :content => "mycontent"
       @host.stubs(:key).returns(key)
       @request.stubs(:generate)
       @request.expects(:save).raises "eh"
 
       lambda { @host.generate_certificate_request }.should raise_error
 
       @host.certificate_request.should be_nil
     end
   end
 
   describe "when managing its certificate" do
     before do
       @realcert = mock 'certificate'
       @cert = stub 'cert', :content => @realcert
 
       @host.stubs(:key).returns mock("key")
       @host.stubs(:certificate_matches_key?).returns true
     end
 
     it "should find the CA certificate if it does not have a certificate" do
       Puppet::SSL::Certificate.expects(:find).with(Puppet::SSL::CA_NAME).returns mock("cacert")
       Puppet::SSL::Certificate.stubs(:find).with("myname").returns @cert
 
       @host.certificate
     end
 
     it "should not find the CA certificate if it is the CA host" do
       @host.expects(:ca?).returns true
       Puppet::SSL::Certificate.stubs(:find)
       Puppet::SSL::Certificate.expects(:find).with(Puppet::SSL::CA_NAME).never
 
       @host.certificate
     end
 
     it "should return nil if it cannot find a CA certificate" do
       Puppet::SSL::Certificate.expects(:find).with(Puppet::SSL::CA_NAME).returns nil
       Puppet::SSL::Certificate.expects(:find).with("myname").never
 
       @host.certificate.should be_nil
     end
 
     it "should find the key if it does not have one" do
       Puppet::SSL::Certificate.stubs(:find)
       @host.expects(:key).returns mock("key")
 
       @host.certificate
     end
 
     it "should generate the key if one cannot be found" do
       Puppet::SSL::Certificate.stubs(:find)
 
       @host.expects(:key).returns nil
       @host.expects(:generate_key)
 
       @host.certificate
     end
 
     it "should find the certificate in the Certificate class and return the Puppet certificate instance" do
       Puppet::SSL::Certificate.expects(:find).with(Puppet::SSL::CA_NAME).returns mock("cacert")
       Puppet::SSL::Certificate.expects(:find).with("myname").returns @cert
 
       @host.certificate.should equal(@cert)
     end
 
     it "should fail if the found certificate does not match the private key" do
       @host.expects(:certificate_matches_key?).returns false
 
       Puppet::SSL::Certificate.stubs(:find).returns @cert
 
       lambda { @host.certificate }.should raise_error(Puppet::Error)
     end
 
     it "should return any previously found certificate" do
       Puppet::SSL::Certificate.expects(:find).with(Puppet::SSL::CA_NAME).returns mock("cacert")
       Puppet::SSL::Certificate.expects(:find).with("myname").returns(@cert).once
 
       @host.certificate.should equal(@cert)
       @host.certificate.should equal(@cert)
     end
   end
 
   it "should have a method for listing certificate hosts" do
     Puppet::SSL::Host.should respond_to(:search)
   end
 
   describe "when listing certificate hosts" do
     it "should default to listing all clients with any file types" do
       Puppet::SSL::Key.expects(:search).returns []
       Puppet::SSL::Certificate.expects(:search).returns []
       Puppet::SSL::CertificateRequest.expects(:search).returns []
       Puppet::SSL::Host.search
     end
 
     it "should be able to list only clients with a key" do
       Puppet::SSL::Key.expects(:search).returns []
       Puppet::SSL::Certificate.expects(:search).never
       Puppet::SSL::CertificateRequest.expects(:search).never
       Puppet::SSL::Host.search :for => Puppet::SSL::Key
     end
 
     it "should be able to list only clients with a certificate" do
       Puppet::SSL::Key.expects(:search).never
       Puppet::SSL::Certificate.expects(:search).returns []
       Puppet::SSL::CertificateRequest.expects(:search).never
       Puppet::SSL::Host.search :for => Puppet::SSL::Certificate
     end
 
     it "should be able to list only clients with a certificate request" do
       Puppet::SSL::Key.expects(:search).never
       Puppet::SSL::Certificate.expects(:search).never
       Puppet::SSL::CertificateRequest.expects(:search).returns []
       Puppet::SSL::Host.search :for => Puppet::SSL::CertificateRequest
     end
 
     it "should return a Host instance created with the name of each found instance" do
       key = stub 'key', :name => "key"
       cert = stub 'cert', :name => "cert"
       csr = stub 'csr', :name => "csr"
 
       Puppet::SSL::Key.expects(:search).returns [key]
       Puppet::SSL::Certificate.expects(:search).returns [cert]
       Puppet::SSL::CertificateRequest.expects(:search).returns [csr]
 
       returned = []
       %w{key cert csr}.each do |name|
         result = mock(name)
         returned << result
         Puppet::SSL::Host.expects(:new).with(name).returns result
       end
 
       result = Puppet::SSL::Host.search
       returned.each do |r|
         result.should be_include(r)
       end
     end
   end
 
   it "should have a method for generating all necessary files" do
     Puppet::SSL::Host.new("me").should respond_to(:generate)
   end
 
   describe "when generating files" do
     before do
       @host = Puppet::SSL::Host.new("me")
       @host.stubs(:generate_key)
       @host.stubs(:generate_certificate_request)
     end
 
     it "should generate a key if one is not present" do
       @host.stubs(:key).returns nil
       @host.expects(:generate_key)
 
       @host.generate
     end
 
     it "should generate a certificate request if one is not present" do
       @host.expects(:certificate_request).returns nil
       @host.expects(:generate_certificate_request)
 
       @host.generate
     end
 
     describe "and it can create a certificate authority" do
       before do
         @ca = mock 'ca'
         Puppet::SSL::CertificateAuthority.stubs(:instance).returns @ca
       end
 
       it "should use the CA to sign its certificate request if it does not have a certificate" do
         @host.expects(:certificate).returns nil
 
         @ca.expects(:sign).with(@host.name, true)
 
         @host.generate
       end
     end
 
     describe "and it cannot create a certificate authority" do
       before do
         Puppet::SSL::CertificateAuthority.stubs(:instance).returns nil
       end
 
       it "should seek its certificate" do
         @host.expects(:certificate)
 
         @host.generate
       end
     end
   end
 
   it "should have a method for creating an SSL store" do
     Puppet::SSL::Host.new("me").should respond_to(:ssl_store)
   end
 
   it "should always return the same store" do
     host = Puppet::SSL::Host.new("foo")
     store = mock 'store'
     store.stub_everything
     OpenSSL::X509::Store.expects(:new).returns store
     host.ssl_store.should equal(host.ssl_store)
   end
 
   describe "when creating an SSL store" do
     before do
       @host = Puppet::SSL::Host.new("me")
       @store = mock 'store'
       @store.stub_everything
       OpenSSL::X509::Store.stubs(:new).returns @store
 
       Puppet.settings.stubs(:value).with(:localcacert).returns "ssl_host_testing"
 
       Puppet::SSL::CertificateRevocationList.stubs(:find).returns(nil)
     end
 
     it "should accept a purpose" do
       @store.expects(:purpose=).with "my special purpose"
       @host.ssl_store("my special purpose")
     end
 
     it "should default to OpenSSL::X509::PURPOSE_ANY as the purpose" do
       @store.expects(:purpose=).with OpenSSL::X509::PURPOSE_ANY
       @host.ssl_store
     end
 
     it "should add the local CA cert file" do
       Puppet.settings.stubs(:value).with(:localcacert).returns "/ca/cert/file"
       @store.expects(:add_file).with "/ca/cert/file"
       @host.ssl_store
     end
 
     describe "and a CRL is available" do
       before do
         @crl = stub 'crl', :content => "real_crl"
         Puppet::SSL::CertificateRevocationList.stubs(:find).returns @crl
         Puppet.settings.stubs(:value).with(:certificate_revocation).returns true
       end
 
       it "should add the CRL" do
         @store.expects(:add_crl).with "real_crl"
         @host.ssl_store
       end
 
       it "should set the flags to OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK" do
         @store.expects(:flags=).with OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK
         @host.ssl_store
       end
     end
   end
 
   describe "when waiting for a cert" do
     before do
       @host = Puppet::SSL::Host.new("me")
     end
 
     it "should generate its certificate request and attempt to read the certificate again if no certificate is found" do
       @host.expects(:certificate).times(2).returns(nil).then.returns "foo"
       @host.expects(:generate)
       @host.wait_for_cert(1)
     end
 
     it "should catch and log errors during CSR saving" do
       @host.expects(:certificate).times(2).returns(nil).then.returns "foo"
       @host.expects(:generate).raises(RuntimeError).then.returns nil
       @host.stubs(:sleep)
       @host.wait_for_cert(1)
     end
 
     it "should sleep and retry after failures saving the CSR if waitforcert is enabled" do
       @host.expects(:certificate).times(2).returns(nil).then.returns "foo"
       @host.expects(:generate).raises(RuntimeError).then.returns nil
       @host.expects(:sleep).with(1)
       @host.wait_for_cert(1)
     end
 
     it "should exit after failures saving the CSR of waitforcert is disabled" do
       @host.expects(:certificate).returns(nil)
       @host.expects(:generate).raises(RuntimeError)
       @host.expects(:puts)
       @host.expects(:exit).with(1).raises(SystemExit)
       lambda { @host.wait_for_cert(0) }.should raise_error(SystemExit)
     end
 
     it "should exit if the wait time is 0 and it can neither find nor retrieve a certificate" do
       @host.stubs(:certificate).returns nil
       @host.expects(:generate)
       @host.expects(:puts)
       @host.expects(:exit).with(1).raises(SystemExit)
       lambda { @host.wait_for_cert(0) }.should raise_error(SystemExit)
     end
 
     it "should sleep for the specified amount of time if no certificate is found after generating its certificate request" do
       @host.expects(:certificate).times(3).returns(nil).then.returns(nil).then.returns "foo"
       @host.expects(:generate)
 
       @host.expects(:sleep).with(1)
 
       @host.wait_for_cert(1)
     end
 
     it "should catch and log exceptions during certificate retrieval" do
       @host.expects(:certificate).times(3).returns(nil).then.raises(RuntimeError).then.returns("foo")
       @host.stubs(:generate)
       @host.stubs(:sleep)
 
       Puppet.expects(:err)
 
       @host.wait_for_cert(1)
     end
   end
 end