fips integration work

broken-ca-cert.pem

08:54:04 sellout:puppetserver justin (master *<>) ‖ cat ~/.puppetlabs/etc/puppet/ssl/certs/ca.pem

-----BEGIN CERTIFICATE-----
MIIFbzCCA1egAwIBAgIBATANBgkqhkiG9w0BAQsFADAfMR0wGwYDVQQDDBRQdXBw
ZXQgQ0E6IGxvY2FsaG9zdDAeFw0xOTA4MDcxNTUzMjhaFw0yNDA4MDYxNTUzMjha
MB8xHTAbBgNVBAMMFFB1cHBldCBDQTogbG9jYWxob3N0MIICIjANBgkqhkiG9w0B
AQEFAAOCAg8AMIICCgKCAgEAoFiE1ox1AuQRuba/vkyy/TbNa+MtBYL1Fbn0BaLm
M6+uXfO8HZLdjthBW0YYOdSIrozPmz/R+9HklZHyxr0IhJHhgOFpeRhA31cj1DIi
Za4SD3vyfjGyiH1B6dYUSy3RyWQqE9QxLCQtI+UwCYpNMqa+EAsycHnhLrkbDfcn
T5+Gx444NJjNiiEKCAIrblVtdhtcx3x8a5lLiW8NU0ChzFBDsrevB36epw3oZ6aj
7ygAJMyrTojbdt4JRBUBftioLyr/K9NojCSCHgAZLc+c7ax9Icg2K6WgjLJXL3Cc
rRMYqn3JjxJjMcgGwiKSGStzxFOc+4J0lFETOAtJU0q+/y7IwoXXHlkYrAEWZzYT
0YR5RTPlGuPJGXqOo9vWhg/mfT0lzA/42aoDnSTrqaOPGDqgyKtjJod4EDIPkzIP
fkzMJPQQQfon9f10382DTq6CY06Gg9g7dyBFSFuITSkGAbeemRS8CHYzmzlKXG7Y
DOWBbu76gGj9CDHppSC/qX2LNr6HtoiRNb6ZxF2LWmm2z8+mixAZv/z/OwJFEejo
JXVlG3ypO5AICkoyTxa1bhPMUu1MjHyHT5OJyDV+lP4fChWCWdUa2kwZx1U9x13w
AFvmgje3kik1A6wNeWDu35+WZ6boclTg/H6rcYtw9IFZeYps6HUm67swO8h7Ntjm
aMkCAwEAAaOBtTCBsjAxBglghkgBhvhCAQ0EJBYiUHVwcGV0IFNlcnZlciBJbnRl
cm5hbCBDZXJ0aWZpY2F0ZTAxBgNVHSMEKjAooSOkITAfMR0wGwYDVQQDDBRQdXBw
ZXQgQ0E6IGxvY2FsaG9zdIIBATApBgNVHQ4EIgQgxA/U6btAtyaEHdqHPRySvHHN
Kb2G9jWndE8MclH4vn8wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
DQYJKoZIhvcNAQELBQADggIBACp4nOJ5daBI557NWmQksMFzLNFv9Q9nKW5XUUoT
Vb/nF96b0MscSgwHWMdDSzK/eNv4N5+BqmfLO6tVhfHSikKDac3InD11wOpod2Rr
4J00Ooda4+39SHUNe5f8h+PF2toAbFYE2hXb9n6SZaz/MzC8/Qrzr+yfZmH54r2d
Df6UaOgxHdremC3KszCChISPev9Zv+u+IPnxVrs8hlGqxYas+zFvDf+x6zpQkCYs
oBkleK8EVMHpodgIN6jWu4vepJjQr9jBMT8P59i12bs/yy0Ze1eQa9IFW8hlG/6f
AQLGiGOLHjMjiMEDcWTf55mpSEk8CYvhEgSXDjMuFaKNNbNBFOYEQ960dVM/6Gd1
dwkvLtYnHMFKRHx+rMBzSToiFNzwlhvLzqH1XDSVPuWYzJNkmieAeR5wiHPTzDBd
2zLsBrJhC0WdxL7uAgLzfdTr1u0b3fhI07FQwsdjc3PUtnJUEPkZxaS43EL0mT/2
FPEh/e+DeAaAyArxMRf2jKNr/uqUKE4ALbKo7fx6uuPmZ8ye5HvIFnsehEdRcosB
rUcd8q83a4VpkGNY77LZ9BTgU3TFwWR2412KQPpp1HLAmqdUkjY+aAtXohKVLyDM
GWQ7zK8jspk/nwmqt0uz8dcYEr5HluKbWeZvbG3wxd6qOfcakk+nUKgJSv6NkgA6
zaWa
-----END CERTIFICATE-----

broken-node-cert.pem

08:54:15 sellout:puppetserver justin (master *<>) ‖ cat ~/.puppetlabs/etc/puppet/ssl/certs/localhost.pem

-----BEGIN CERTIFICATE-----
MIIFtDCCA5ygAwIBAgIBAjANBgkqhkiG9w0BAQsFADAfMR0wGwYDVQQDDBRQdXBw
ZXQgQ0E6IGxvY2FsaG9zdDAeFw0xOTA4MDcxNTUzMzJaFw0yNDA4MDYxNTUzMzJa
MBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC
AgoCggIBAJYT99PnlNo9AiK2AkNCMdMgBEU9Ke58Vt5VkmTyqUu4DJJWCqWBkTyb
BC5IaeZK9uquvBQucon6VoRnfQ/Gb0NF6+Cy9enX2IN48sFp0x+RM1hFLsacq1tn
cUM6tGPV3KW6wbeXn+BCi557921+RLlVjUZFTlJ9G/YcYA1bnGGIwi3xads8gulw
ukhM3+yPUjVHJIDj5Poeo/NhT4/2ZwOamvk97vNHnnuf8i4NRq5TsPItUH6tlmpR
dCHgfwesSIjRbvz6AGK/sAz3f57nBp1zqQtj7M3VDi/qDSs9PGIMHXi3pcwR6jU9
VIX3zA5dtPCSlWaXeRRazcQfa+uZzdfVcAmi1ZDAl5akerVfgRy7syF0i82nvJjE
+okcmll4XaroWfQuazoxqdBIrTvhsw4P84tHmvKYxLAI8bJeEOrpAjb5FF+y5fuc
LE69/2hCEDkRPQVaZmjLVPsR1Rw1spkSipZQDNlcHNIi+jGaI4enWaUlfG1psIwY
6391KzIR2/2H6xLf9oKcM4cOuUeuY5fCxqnfi2x495TsACgyNopWPjEYxmf1wcf0
n8XSFRlBX5uwha9WXD6Aw/5fQQxnoDr4lDGoui+8P9ZHVesPz7JXXIBk1/ppT/C8
7g//49lP/smtzQQiHBD4VxrNVbzOYiID5mtENXCteAQ4xXQ8BkJBAgMBAAGjggEE
MIIBADAxBglghkgBhvhCAQ0EJBYiUHVwcGV0IFNlcnZlciBJbnRlcm5hbCBDZXJ0
aWZpY2F0ZTArBgNVHSMEJDAigCDED9Tpu0C3JoQd2oc9HJK8cc0pvYb2Nad0Twxy
Ufi+fzApBgNVHQ4EIgQg8pBkIN15PAoJyTQ7QYlXKS66a7pox2np7gnBfeR9iykw
FQYLKwYBBAGCjEwBAycEBgwEdHJ1ZTAcBgNVHREEFTATggZwdXBwZXSCCWxvY2Fs
aG9zdDAMBgNVHRMBAf8EAjAAMCAGA1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEF
BQcDAjAOBgNVHQ8BAf8EBAMCBaAwDQYJKoZIhvcNAQELBQADggIBAI1X8c5LuNlA
LbUnNwDtY460CCi5XqHtAMpr1/+5zEV47PxqWjMleGtpx30LCTFvldYH9lAewtFV
G7ThY5iLJ/gcgCoxO6UxCdSCHFyftefkpu50cqR759adoJ6fKXrJz/WgbkFxW8Z6
sqG0cM072D3xf0EnOqdgnHZcfy6Qj8KLB98rhrHLpqo6BZw8KYXkgmXvfX/P7BgJ
8LGCYZD9oK7/VvHfQ0ZdARliBdj+76kDoqrEw/llH60G68NPGCVLFydqHreQk69b
CmJnbr5NzR9O7yO6ThorRG0JZs2QdO5d6I/WvWbDBta1rue5E4aIRLBUNuLBLNPC
FDtnTXyU/aLMGzim0b9cH140MDOk9SGvqM3lur6+hXnVXJD8P8tBlkzKR8SPKTIR
xqkH67EtVk9MoJIDWH1u1a2YTldzfqXc0DoCO05XI81pdZxwjmGA/7ojff7uKLii
kqeeIH+6fex1wSzrUZ5AzfKeu7i+ieJRhxLO64rJB8C2H75gO3oZc/9CGESLZfRq
EneuJwdvuaxED8KlCx1wpp4y5LHcbG5Gor0KM2bnIHel0oSPKPsU74xJqbUx4Aco
tnjD5YFkZvdF1IckiU1iHIcRd9h1nusCs6ZnrKos9Z+6bC+6aVaw/kbJxepM8oJ+
bPkfKYUmRF0UP8YlOZiiCiyx4DQepPZp
-----END CERTIFICATE-----

curl-broken-with-explicit-cipher.sh

23:33:22 sellout:puppetserver justin (master *<>) ‖ curl  https://localhost:8140/puppet/v3/catalog/localhost?environment=production --key ~/.puppetlabs/etc/puppet/ssl/
private_keys/localhost.pem --cert ~/.puppetlabs/etc/puppet/ssl/certs/localhost.pem --cacert ~/.puppetlabs/etc/puppet/ssl/certs/ca.pem  -vvvv --ciphers ECDHE-RSA-AES256
-SHA384
*   Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 8140 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ECDHE-RSA-AES256-SHA384
* successfully set certificate verify locations:
*   CAfile: /Users/justin/.puppetlabs/etc/puppet/ssl/certs/ca.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Request CERT (13):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS handshake, CERT verify (15):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS alert, Server hello (2):
* error:1401E416:SSL routines:CONNECT_CR_FINISHED:sslv3 alert certificate unknown
* stopped the pause stream!
* Closing connection 0
curl: (35) error:1401E416:SSL routines:CONNECT_CR_FINISHED:sslv3 alert certificate unknown

curl-broken.sh

23:18:29 sellout:puppetserver justin (master *<>) ‖ curl  https://localhost:8140/puppet/v3/catalog/localhost?environment=production --key ~/.puppetlabs/etc/puppet/ssl/
private_keys/localhost.pem --cert ~/.puppetlabs/etc/puppet/ssl/certs/localhost.pem --cacert ~/.puppetlabs/etc/puppet/ssl/certs/ca.pem  -vvvv
*   Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 8140 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /Users/justin/.puppetlabs/etc/puppet/ssl/certs/ca.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Request CERT (13):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS handshake, CERT verify (15):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS alert, Server hello (2):
* error:1401E416:SSL routines:CONNECT_CR_FINISHED:sslv3 alert certificate unknown
* stopped the pause stream!
* Closing connection 0
curl: (35) error:1401E416:SSL routines:CONNECT_CR_FINISHED:sslv3 alert certificate unknown

curl-working.sh

23:38:11 sellout:puppetserver justin (master *<>) ‖ curl  https://localhost:8140/puppet/v3/catalog/localhost?environment=production --key ~/.puppetlabs/etc/puppet/ssl/
private_keys/localhost.pem --cert ~/.puppetlabs/etc/puppet/ssl/certs/localhost.pem --cacert ~/.puppetlabs/etc/puppet/ssl/certs/ca.pem  -vvvv --ciphers ECDHE-RSA-AES256
-SHA384
*   Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 8140 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ECDHE-RSA-AES256-SHA384
* successfully set certificate verify locations:
*   CAfile: /Users/justin/.puppetlabs/etc/puppet/ssl/certs/ca.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Request CERT (13):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS handshake, CERT verify (15):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: CN=localhost
*  start date: Aug  7 06:40:04 2019 GMT
*  expire date: Aug  6 06:40:04 2024 GMT
*  subjectAltName: host "localhost" matched cert's "localhost"
*  issuer: CN=Puppet CA: localhost
*  SSL certificate verify ok.
> GET /puppet/v3/catalog/localhost?environment=production HTTP/1.1
> Host: localhost:8140
> User-Agent: curl/7.54.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Date: Thu, 08 Aug 2019 06:40:21 GMT
< Content-Type: application/vnd.puppet.rich+json; charset=utf-8
< X-Puppet-Version: 6.8.0
< Vary: Accept-Encoding, User-Agent
< Content-Length: 594
<
* Connection #0 to host localhost left intact
{"tags":["settings"],"name":"localhost","version":1565246421,"code_id":null,"catalog_uuid":"8393a6a6-f167-4637-af79-87ff6ecab761","catalog_format":1,"environment":"pro
duction","resources":[{"type":"Stage","title":"main","tags":["stage"],"exported":false,"parameters":{"name":"main"}},{"type":"Class","title":"Settings","tags":["class"
,"settings"],"exported":false},{"type":"Class","title":"main","tags":["class"],"exported":false,"parameters":{"name":"main"}}],"edges":[{"source":"Stage[main]","target

example-test-failure.sh

08:55:48 sellout:puppetserver justin (master *<>) ‖ lein test :only puppetlabs.general-puppet.general-puppet-int-test/test-config-version-execution
Using 1G min heap since not set via PUPPETSERVER_HEAP_SIZE environment variable or user.puppetserver-heap-size in ~/.lein/profiles.clj file. Set to at least 5G for best performance during test runs.
...skip...
08:56:09,313 |-INFO in ch.qos.logback.classic.joran.JoranConfigurator@3fddabba - Registering current configuration as safe fallback point

lein test :only puppetlabs.general-puppet.general-puppet-int-test/test-config-version-execution
ERROR in (test-config-version-execution) (Alerts.java:208)
Uncaught exception, not in assertion.
expected: nil
  actual: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
 at sun.security.ssl.Alerts.getSSLException (Alerts.java:208)
    sun.security.ssl.SSLEngineImpl.fatal (SSLEngineImpl.java:1666)
    sun.security.ssl.SSLEngineImpl.fatal (SSLEngineImpl.java:1634)
    sun.security.ssl.SSLEngineImpl.recvAlert (SSLEngineImpl.java:1800)
    sun.security.ssl.SSLEngineImpl.readRecord (SSLEngineImpl.java:1083)
    sun.security.ssl.SSLEngineImpl.readNetRecord (SSLEngineImpl.java:907)
    sun.security.ssl.SSLEngineImpl.unwrap (SSLEngineImpl.java:781)
    javax.net.ssl.SSLEngine.unwrap (SSLEngine.java:624)
    org.apache.http.nio.reactor.ssl.SSLIOSession.doUnwrap (SSLIOSession.java:273)
    org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake (SSLIOSession.java:328)
    org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady (SSLIOSession.java:509)
    org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady (AbstractIODispatch.java:120)
    org.apache.http.impl.nio.reactor.BaseIOReactor.readable (BaseIOReactor.java:162)
    org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent (AbstractIOReactor.java:337)
    org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents (AbstractIOReactor.java:315)
    org.apache.http.impl.nio.reactor.AbstractIOReactor.execute (AbstractIOReactor.java:276)
    org.apache.http.impl.nio.reactor.BaseIOReactor.execute (BaseIOReactor.java:104)
    org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run (AbstractMultiworkerIOReactor.java:588)
    java.lang.Thread.run (Thread.java:748)
Ran 1 tests containing 1 assertions.
0 failures, 1 errors.
Tests failed.

openssl-broken-explicit-cipher.sh

23:34:15 sellout:puppetserver justin (master *<>) ‖ openssl s_client -connect localhost:8140 -cert ~/.puppetlabs/etc/puppet/ssl/certs/localhost.pem -key ~/.puppetlabs/
etc/puppet/ssl/private_keys/localhost.pem -CAfile ~/.puppetlabs/etc/puppet/ssl/certs/ca.pem -cipher ECDHE-RSA-AES256-SHA384
CONNECTED(00000005)
depth=1 CN = Puppet CA: localhost
verify return:1
depth=0 CN = localhost
verify return:1
4614588012:error:1401E416:SSL routines:CONNECT_CR_FINISHED:sslv3 alert certificate unknown:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.260.1/l
ibressl-2.6/ssl/ssl_pkt.c:1205:SSL alert number 46
4614588012:error:1401E0E5:SSL routines:CONNECT_CR_FINISHED:ssl handshake failure:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.260.1/libressl-2.
6/ssl/ssl_pkt.c:585:
---
Certificate chain
 0 s:/CN=localhost
   i:/CN=Puppet CA: localhost
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFtDCCA5ygAwIBAgIBAjANBgkqhkiG9w0BAQsFADAfMR0wGwYDVQQDDBRQdXBw
ZXQgQ0E6IGxvY2FsaG9zdDAeFw0xOTA4MDcwNTI4MDZaFw0yNDA4MDYwNTI4MDZa
MBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC
AgoCggIBAKGYazUP+8fO1/K6cIBZPP9RQqh0fcth3VqfWYaTdDQiT/2lXDy5JJAF
Mom7bbV73lBn6upneD5PFboPHv7YS2+/z1iSrVYFs1LjrGKjJDQCQKITm1bcTMrf
EQFV0tm3tZP/REpMNcZOcs0+MtL+p1Mcrjqahu6EdZBR+kkQBz40qMWXDE8gfaFl
Xvn5tmml5rVWvc+uAsPeSynQYi4qdAuY51Ty+ZXZpewC42cafnr+idi/vbA0udMs
Z2TqeHudqxVhEHhCYbqwpFaHZkR+n2pSCNzVxWoyQ+Y6FMvDV9uRK9cnJrR0EEfv
GMzI4o9Y1z8lng5yQURlIMdibIjJQVeQhNfLAYzsMAI270y+uSRZu4i1Y1wpbTVI
+XS1eb3YB5lwjEiAFvLtoKm38/cfOR1k4ZLnedQZ4sW/vb6wYXWzdOykw82zKIHp
agY6cYk4vcE2ylA9ll5sWLqZ8ud2NpPVskim1/cIV72Voz3NjvRfiYWqXl5jjlOM
wKpz3sA+WlcChvpA1eE6NgPoq2O1GpVxSMWeaSakgSGuX71rgKU81039TmRnhS4c
5VGTrnWAVbXosmJ3iW6Q9uRoPNSG+FAn1odH1XCkDXCKO5VXjwIlb3z4cy+HezyK
2yOAoKn9Clkk3uogq5UDETyji2Te2LHkdKW288ojvY09W5jmWhYzAgMBAAGjggEE
MIIBADAxBglghkgBhvhCAQ0EJBYiUHVwcGV0IFNlcnZlciBJbnRlcm5hbCBDZXJ0
aWZpY2F0ZTArBgNVHSMEJDAigCCiED4UZVU1x5wdzkT6rn9RxfLVS+zGKHrAd8Fm
pvsJXDApBgNVHQ4EIgQgb8Nvezm9f/SDKjt1sK/EIoyA71xw6zMY/nZmOEjH9fgw
FQYLKwYBBAGCjEwBAycEBgwEdHJ1ZTAcBgNVHREEFTATggZwdXBwZXSCCWxvY2Fs
aG9zdDAMBgNVHRMBAf8EAjAAMCAGA1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEF
BQcDAjAOBgNVHQ8BAf8EBAMCBaAwDQYJKoZIhvcNAQELBQADggIBALtEpoXbVjLr
K0oWV5kDaB6BYyyPVbyIUaC6QoOxdMl4W8vpYuaB3P+t6hvwUAA1THLuQNS2h+el
LlvBbcfZCXpAcEon/45SDF4En+ouZ3E0/xwV4G4tTw6uevlWyG/A9+P6CmqYOaBS
QKnVHDo7wkU9JpuoVFJrYjqQY3BlCWVFZfyv0XvYqKIBLX2R8mNgG/yGC7ehCM17
tSizCm9rXI9v4jwJ4NvHW8smlDZ5E+tAJqftjTdUrwAf3bGdsjJ9fkmd3MIMIcdS
CmHtqsnQY8ti+l79Wl1MCioqb3ZhJCi87jrjeapZLfM0W8/7x0H4g4BTp8iCz+wU
3DocmKoCSF1hkL+EMT3Roc11Iy5e77If9cKxwC5Iw1qX+XeJPHRXhIOQY5r5kOb1
fOc4kkn/zelYH1Iwis1tb3R+58ttkZQ0tR6O+BetvOj5c06ZsmKzPh/tcbeoWSY4
BYA1dAtOr2Skgfla6YqUdnJ2qhefIFB2QrXre1pdwrQd8/0D6+dBJMwC2uDOBbQT
hZKahhEyPSzMusGYBa/j4Vzd4m7qy9kloJXeiMKzucQa5rD+I2V48ZffH5WtvHHL
oVUz3HCOyzEtcNUEDtM5YHA6VSKdkTj+lY/7ar5VZPKgl/JrgbL+qDnxmH1/PcYt
3hZfWIt3A1KfTgnqWexEwQCoRPiJYkGk
-----END CERTIFICATE-----
subject=/CN=localhost
issuer=/CN=Puppet CA: localhost
---
Acceptable client certificate CA names
/CN=Puppet CA: localhost
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 2233 bytes and written 3584 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA384
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-SHA384
    Session-ID: 5D4BC27D8973A40EB13BCF9054127EC9D01FC063586C446415128AB2DA08F065
    Session-ID-ctx:
    Master-Key: 3AFE318F6E0C188D338A4E41B60552C776166C470F1052C5563D8C3F1F5C11503281F2124B553E8C925216D41A8E0F10
    Start Time: 1565246077
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

openssl-broken.sh

23:16:16 sellout:puppetserver justin (master *<>) ‖ openssl s_client -connect localhost:8140 -cert ~/.puppetlabs/etc/puppet/ssl/certs/localhost.pem -key ~/.puppetlabs/
etc/puppet/ssl/private_keys/localhost.pem -CAfile ~/.puppetlabs/etc/puppet/ssl/certs/ca.pem
CONNECTED(00000005)
depth=1 CN = Puppet CA: localhost
verify return:1
depth=0 CN = localhost
verify return:1
4638377580:error:1401E416:SSL routines:CONNECT_CR_FINISHED:sslv3 alert certificate unknown:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.260.1/l
ibressl-2.6/ssl/ssl_pkt.c:1205:SSL alert number 46
4638377580:error:1401E0E5:SSL routines:CONNECT_CR_FINISHED:ssl handshake failure:/BuildRoot/Library/Caches/com.apple.xbs/Sources/libressl/libressl-22.260.1/libressl-2.
6/ssl/ssl_pkt.c:585:
---
Certificate chain
 0 s:/CN=localhost
   i:/CN=Puppet CA: localhost
---
Server certificate
-----BEGIN CERTIFICATE-----                                                                                                                                 [2804/9843]
MIIFtDCCA5ygAwIBAgIBAjANBgkqhkiG9w0BAQsFADAfMR0wGwYDVQQDDBRQdXBw
ZXQgQ0E6IGxvY2FsaG9zdDAeFw0xOTA4MDcwNTI4MDZaFw0yNDA4MDYwNTI4MDZa
MBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC
AgoCggIBAKGYazUP+8fO1/K6cIBZPP9RQqh0fcth3VqfWYaTdDQiT/2lXDy5JJAF
Mom7bbV73lBn6upneD5PFboPHv7YS2+/z1iSrVYFs1LjrGKjJDQCQKITm1bcTMrf
EQFV0tm3tZP/REpMNcZOcs0+MtL+p1Mcrjqahu6EdZBR+kkQBz40qMWXDE8gfaFl
Xvn5tmml5rVWvc+uAsPeSynQYi4qdAuY51Ty+ZXZpewC42cafnr+idi/vbA0udMs
Z2TqeHudqxVhEHhCYbqwpFaHZkR+n2pSCNzVxWoyQ+Y6FMvDV9uRK9cnJrR0EEfv
GMzI4o9Y1z8lng5yQURlIMdibIjJQVeQhNfLAYzsMAI270y+uSRZu4i1Y1wpbTVI
+XS1eb3YB5lwjEiAFvLtoKm38/cfOR1k4ZLnedQZ4sW/vb6wYXWzdOykw82zKIHp
agY6cYk4vcE2ylA9ll5sWLqZ8ud2NpPVskim1/cIV72Voz3NjvRfiYWqXl5jjlOM
wKpz3sA+WlcChvpA1eE6NgPoq2O1GpVxSMWeaSakgSGuX71rgKU81039TmRnhS4c
5VGTrnWAVbXosmJ3iW6Q9uRoPNSG+FAn1odH1XCkDXCKO5VXjwIlb3z4cy+HezyK
2yOAoKn9Clkk3uogq5UDETyji2Te2LHkdKW288ojvY09W5jmWhYzAgMBAAGjggEE
MIIBADAxBglghkgBhvhCAQ0EJBYiUHVwcGV0IFNlcnZlciBJbnRlcm5hbCBDZXJ0
aWZpY2F0ZTArBgNVHSMEJDAigCCiED4UZVU1x5wdzkT6rn9RxfLVS+zGKHrAd8Fm
pvsJXDApBgNVHQ4EIgQgb8Nvezm9f/SDKjt1sK/EIoyA71xw6zMY/nZmOEjH9fgw
FQYLKwYBBAGCjEwBAycEBgwEdHJ1ZTAcBgNVHREEFTATggZwdXBwZXSCCWxvY2Fs
aG9zdDAMBgNVHRMBAf8EAjAAMCAGA1UdJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEF
BQcDAjAOBgNVHQ8BAf8EBAMCBaAwDQYJKoZIhvcNAQELBQADggIBALtEpoXbVjLr
K0oWV5kDaB6BYyyPVbyIUaC6QoOxdMl4W8vpYuaB3P+t6hvwUAA1THLuQNS2h+el
LlvBbcfZCXpAcEon/45SDF4En+ouZ3E0/xwV4G4tTw6uevlWyG/A9+P6CmqYOaBS
QKnVHDo7wkU9JpuoVFJrYjqQY3BlCWVFZfyv0XvYqKIBLX2R8mNgG/yGC7ehCM17
tSizCm9rXI9v4jwJ4NvHW8smlDZ5E+tAJqftjTdUrwAf3bGdsjJ9fkmd3MIMIcdS
CmHtqsnQY8ti+l79Wl1MCioqb3ZhJCi87jrjeapZLfM0W8/7x0H4g4BTp8iCz+wU
3DocmKoCSF1hkL+EMT3Roc11Iy5e77If9cKxwC5Iw1qX+XeJPHRXhIOQY5r5kOb1
fOc4kkn/zelYH1Iwis1tb3R+58ttkZQ0tR6O+BetvOj5c06ZsmKzPh/tcbeoWSY4
BYA1dAtOr2Skgfla6YqUdnJ2qhefIFB2QrXre1pdwrQd8/0D6+dBJMwC2uDOBbQT
hZKahhEyPSzMusGYBa/j4Vzd4m7qy9kloJXeiMKzucQa5rD+I2V48ZffH5WtvHHL
oVUz3HCOyzEtcNUEDtM5YHA6VSKdkTj+lY/7ar5VZPKgl/JrgbL+qDnxmH1/PcYt
3hZfWIt3A1KfTgnqWexEwQCoRPiJYkGk
-----END CERTIFICATE-----
subject=/CN=localhost
issuer=/CN=Puppet CA: localhost
---
Acceptable client certificate CA names
/CN=Puppet CA: localhost
Server Temp Key: DH, 2048 bits
---
SSL handshake has read 2683 bytes and written 3760 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES128-SHA256
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : DHE-RSA-AES128-SHA256
    Session-ID: 5D4BBEB559A02FAB48F4EE9F0B740F8F037DF9A801FC150CC20DB935A9E0DFCA
    Session-ID-ctx:
    Master-Key: 2F119A0DCC7A0D9AC414A4EA688CB4402B53CDCE8C886BE3A678F468037D14A4945B59E8689435347DDC3155C03CD1AA
    Start Time: 1565245109
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

openssl-working.sh

23:40:22 sellout:puppetserver justin (master *<>) ‖ openssl s_client -connect localhost:8140 -cert ~/.puppetlabs/etc/puppet/ssl/certs/localhost.pem -key ~/.puppetlabs/
etc/puppet/ssl/private_keys/localhost.pem -CAfile ~/.puppetlabs/etc/puppet/ssl/certs/ca.pem -cipher ECDHE-RSA-AES256-SHA384
CONNECTED(00000005)
depth=1 CN = Puppet CA: localhost
verify return:1
depth=0 CN = localhost
verify return:1
---
Certificate chain
 0 s:/CN=localhost
   i:/CN=Puppet CA: localhost
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFmjCCA4KgAwIBAgIBAjANBgkqhkiG9w0BAQsFADAfMR0wGwYDVQQDDBRQdXBw
ZXQgQ0E6IGxvY2FsaG9zdDAeFw0xOTA4MDcwNjQwMDRaFw0yNDA4MDYwNjQwMDRa
MBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC
AgoCggIBAKsVgsgF11OqhF8tOpUbWBxQ7sQIQ5SaPD9P3LQm9WoE/JgFx97nVCZ6
DkPyPnsr1inNpMVqUnFBwyWa4UP1RLMgACSFdj3sH6jf/ExMnRSF8FEgO9WR6aLo
KWmInGHseyjBV7e5B5VllCghp7UMc5hlif4YE5AatMvBjoQIVfT3BfNk+CEs8BtD
cqMitjQ6kHjbj2Xv+d5lEwiL0VXxD7KZjQx/TGYOP73K0/WpRZwkRO5emF68dw6u
ka4ICPRDSTorwSjE/R75VoEYQ707NjrUh9180g+gbKouBtmsEt4ctKblU+6hRRGh
LlVXpVC8xaFpCmH4XdGjydjk29gAjTKIySk9One2k8FlSaXW6UQqAon8OvqrgYRc
pnVXifjTccyaRGKk2Q45cgUeyozOjTcHWFwDE7JxYDc6qMOm9cBrmjUVeikmHkaT
joWHihekbSr0IA8KGN2k500xTS3xwwfDYlvn2k/zvd2inWUAWPwtA3V1PPc+joZn
Fm7zYde0pSm1tjI0lWHvsrW1uUk9NgsRyjxJA5+AFR6P7dA022Nzy2MK1fAjRXws
tSWBZ7VEOFo0GPn80OSZ7rpFNL/1U9eqYgXP/Y1bJv03X2TndHJq8/CSYZSTdfOV
LSpBv8QBGl1uRIevcA3Ki/9YhFTfOEgvOGu/dVUtW7zzBF+X6HPfAgMBAAGjgesw
gegwMQYJYIZIAYb4QgENBCQWIlB1cHBldCBTZXJ2ZXIgSW50ZXJuYWwgQ2VydGlm
aWNhdGUwHwYDVR0jBBgwFoAUi3McS33b2KHavNbU8O0cn89WQKYwHQYDVR0OBBYE
FFc6fZ5XYFlwKthRnANtovEL8xl1MBUGCysGAQQBgoxMAQMnBAYMBHRydWUwHAYD
VR0RBBUwE4IGcHVwcGV0gglsb2NhbGhvc3QwDAYDVR0TAQH/BAIwADAgBgNVHSUB
Af8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDgYDVR0PAQH/BAQDAgWgMA0GCSqG
SIb3DQEBCwUAA4ICAQCOAZ+o1YWyACIv/63/8t0bCbU/oku/9UlW/OTWeYT6QIKd
0ICqnxgyLw2vNKOkj1tWaCty9cw/9nDKtGfOx97T502m6jg4CU/ihhjoHAbuFxba
OvW/2hJVjDx8+SBYqRhJs0IVnbSB9/+CNe0mZQ/ayLgG63VM5Aw0Jb9SwIWdUr0c
3jrQVIaCEcorkfRRse9SiB8jEGTkuWmfbzTK98K5Xw4ZIbRKGAatA6wuKunyjJaK
HH+Z8iBZLWG4p7QrS57SgnluLMOdGJa3Vkd2GpPo5I1tUbeEHUdye9af+23Xkqdx
K2zmxu5xw09fvIF1qednHwj83LFXgqF9jGP31l+XcHVvG08ApmVp6VN0XaDSvpdX
HQxlkKlsWJMy5VkuSwq0Rx5bz7zYjj/rHfc0/jQvdzX0GJK35/y1tz0iPzb1kTcb
5MBqaI9xFKNQyJB7729xaNAKpOvgJlgc6hHBWSlnk2JmvnVjFexnaviPFVl0tc6t
yMZkccona1d6Jwzgfp8UvYHTPda8g0SGTKur4BDij/ecNh7rW+DVri7Fw7IHcAO3
ssb1nEMMSYid9LZEpI5+Yf0Etwji9kevTMeLR+zZwQyHDHhJSkOa8LY07W1lc5fc
111pyt/26N8ae/zF8Z32rOfl1cN+dx7CQGlIkzJMTgus8n7kk+sUWzjnFvoqqQ==
-----END CERTIFICATE-----
subject=/CN=localhost
issuer=/CN=Puppet CA: localhost
---
Acceptable client certificate CA names
/CN=Puppet CA: localhost
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 2307 bytes and written 3654 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA384
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-SHA384
    Session-ID: 5D4BC3E61A8897C49568DA60B19C894379412CF3BB0802E968BB42212E875D66
    Session-ID-ctx:
    Master-Key: F73F1535474359BB8E1C2033B5BF8A327BE85D9DF81F8C3C0D0F050489B6EB0A39EEA05EB828E400B8B40F8934A8EA38
    Start Time: 1565246438
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---
closed

working-ca-cert.pem

08:48:57 sellout:puppetserver justin (master *<>) ‖ cat ~/.puppetlabs/etc/puppet/ssl/certs/ca.pem

-----BEGIN CERTIFICATE-----
MIIFYzCCA0ugAwIBAgIBATANBgkqhkiG9w0BAQsFADAfMR0wGwYDVQQDDBRQdXBw
ZXQgQ0E6IGxvY2FsaG9zdDAeFw0xOTA4MDcwNjQwMDJaFw0yNDA4MDYwNjQwMDJa
MB8xHTAbBgNVBAMMFFB1cHBldCBDQTogbG9jYWxob3N0MIICIjANBgkqhkiG9w0B
AQEFAAOCAg8AMIICCgKCAgEAoRh5yP/Ia0knTRj3LHord08lLoQJlJvHmPK4sJVS
+Xs5A56lxk3FxwotRM7IC7Pd4X5CgLbmFKbO1qXfRNL0wUE3nwD6TtkUMlbzWgqM
4wPaJvUod6lA2E4Jf/TNeXvPUQ7V9xESvsY1/31q/cwpm+m6vzUjqKrqu6R6ULs9
6/olrGgbKHAgjpeC5aXBzVA2Uy+6XcKqDK/u9iS/VYq6unDH5ubxv7PghJe78qYX
DQpF7FWMOe/GnpYDQB8sa2GTeoALFf2XlrEw71Py/XpMBLgkTe+pn1D5pqGa81zK
Xut/Q8JUDg0s/IP1ECUO9tJqLlylUBzJmE4lx3NftEHce4F9jZtBfu8BQyMDhzpH
zLyUetduLXHLCcFcosSNy2h3k/DrdbnJJHn3T5lkZhS5lF2tnXgWIWT7YSi0MaQU
A71rAl/e1IaOchs1emp2Mi8yglfNbP9sVQ2uDX46siYHM3N1QQbFL1yEuXvW6TA9
fTa/v/X2uKPoZdKIetYiF0cHIMln30s+f1TeX6bxcamzw1p5EnV4zyOsQv4TUBJC
iccxeHsYzKHv03UWldxzIQtUrBf9Doqy8RBdTlyl0rq+aF+djmEhFJoicxDLF6BK
J/VAIS792BzL7q4KL4JQfTym6/55YL/bRIOwlNnkXJx9u0YZUZdE1/9WlQDwIhEv
v5sCAwEAAaOBqTCBpjAxBglghkgBhvhCAQ0EJBYiUHVwcGV0IFNlcnZlciBJbnRl
cm5hbCBDZXJ0aWZpY2F0ZTAxBgNVHSMEKjAooSOkITAfMR0wGwYDVQQDDBRQdXBw
ZXQgQ0E6IGxvY2FsaG9zdIIBATAdBgNVHQ4EFgQUi3McS33b2KHavNbU8O0cn89W
QKYwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQEL
BQADggIBADNgOVj9u5iOrgoI6ytNnfPImJSz74TkJvtNufdF2MLTHJ219gf8c6L1
2gAFKuQQmEvgAzYwqXFotz4MO0OsgFcWCq1DLrBIaWqitBY/VtD/PhYgbOsCHSQ5
Am05bvM6QgIU/Anbht2u/VTYKt8acSkPIg0vP5R0gEZNZws9nKeIl2IiWEzNkMDj
0WgdnUg2srHYJ90yDCeb8gvI0INGSXiXfwTdeS9Yg3Dr11kDUnnYIyXdAWWcm6FU
K4rQvBM68OsWKV66q9AdEVqc/cWxlBldP57uOSG4ueWuyBZxiyHclBcXunSOjdjl
FrpbAUgDyGXwkZCbaexytMb9VVgLN0eQ9MKtdpU+u/T3KTTp9ovsSGD7Id/kU4+h
oeYtJVhEsaFvPWyrY3sPghs19HU2I4YK04rCICXnOErQGBF85PT9Amr+0YWN3kMN
E52PMRIqDc7a0cf4uYOS7C2IkBh/c8nMukoO3bLY1O7qdUe+t2a2NHkwcxpdpuhN
SCfvMSq+8lq4WsjunoX+k/TgPNTWzb39Ny6i/XzBmKEDIOnIRQghLf5r/P/S3xmk
18tGt5cz88IbvgbpKFxXzPkR7C9XbChomnPaD0MRRw3rh8vkUWpUv2qcLBzb+YG+
OgKD5lHBccdVanp8gEaw+EX1Y9Io445xiZJ+PziPGA9wV8+KLiib
-----END CERTIFICATE-----

working-node-cert.pem

08:49:10 sellout:puppetserver justin (master *<>) ‖ cat ~/.puppetlabs/etc/puppet/ssl/certs/localhost.pem

-----BEGIN CERTIFICATE-----
MIIFmjCCA4KgAwIBAgIBAjANBgkqhkiG9w0BAQsFADAfMR0wGwYDVQQDDBRQdXBw
ZXQgQ0E6IGxvY2FsaG9zdDAeFw0xOTA4MDcwNjQwMDRaFw0yNDA4MDYwNjQwMDRa
MBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC
AgoCggIBAKsVgsgF11OqhF8tOpUbWBxQ7sQIQ5SaPD9P3LQm9WoE/JgFx97nVCZ6
DkPyPnsr1inNpMVqUnFBwyWa4UP1RLMgACSFdj3sH6jf/ExMnRSF8FEgO9WR6aLo
KWmInGHseyjBV7e5B5VllCghp7UMc5hlif4YE5AatMvBjoQIVfT3BfNk+CEs8BtD
cqMitjQ6kHjbj2Xv+d5lEwiL0VXxD7KZjQx/TGYOP73K0/WpRZwkRO5emF68dw6u
ka4ICPRDSTorwSjE/R75VoEYQ707NjrUh9180g+gbKouBtmsEt4ctKblU+6hRRGh
LlVXpVC8xaFpCmH4XdGjydjk29gAjTKIySk9One2k8FlSaXW6UQqAon8OvqrgYRc
pnVXifjTccyaRGKk2Q45cgUeyozOjTcHWFwDE7JxYDc6qMOm9cBrmjUVeikmHkaT
joWHihekbSr0IA8KGN2k500xTS3xwwfDYlvn2k/zvd2inWUAWPwtA3V1PPc+joZn
Fm7zYde0pSm1tjI0lWHvsrW1uUk9NgsRyjxJA5+AFR6P7dA022Nzy2MK1fAjRXws
tSWBZ7VEOFo0GPn80OSZ7rpFNL/1U9eqYgXP/Y1bJv03X2TndHJq8/CSYZSTdfOV
LSpBv8QBGl1uRIevcA3Ki/9YhFTfOEgvOGu/dVUtW7zzBF+X6HPfAgMBAAGjgesw
gegwMQYJYIZIAYb4QgENBCQWIlB1cHBldCBTZXJ2ZXIgSW50ZXJuYWwgQ2VydGlm
aWNhdGUwHwYDVR0jBBgwFoAUi3McS33b2KHavNbU8O0cn89WQKYwHQYDVR0OBBYE
FFc6fZ5XYFlwKthRnANtovEL8xl1MBUGCysGAQQBgoxMAQMnBAYMBHRydWUwHAYD
VR0RBBUwE4IGcHVwcGV0gglsb2NhbGhvc3QwDAYDVR0TAQH/BAIwADAgBgNVHSUB
Af8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDgYDVR0PAQH/BAQDAgWgMA0GCSqG
SIb3DQEBCwUAA4ICAQCOAZ+o1YWyACIv/63/8t0bCbU/oku/9UlW/OTWeYT6QIKd
0ICqnxgyLw2vNKOkj1tWaCty9cw/9nDKtGfOx97T502m6jg4CU/ihhjoHAbuFxba
OvW/2hJVjDx8+SBYqRhJs0IVnbSB9/+CNe0mZQ/ayLgG63VM5Aw0Jb9SwIWdUr0c
3jrQVIaCEcorkfRRse9SiB8jEGTkuWmfbzTK98K5Xw4ZIbRKGAatA6wuKunyjJaK
HH+Z8iBZLWG4p7QrS57SgnluLMOdGJa3Vkd2GpPo5I1tUbeEHUdye9af+23Xkqdx
K2zmxu5xw09fvIF1qednHwj83LFXgqF9jGP31l+XcHVvG08ApmVp6VN0XaDSvpdX
HQxlkKlsWJMy5VkuSwq0Rx5bz7zYjj/rHfc0/jQvdzX0GJK35/y1tz0iPzb1kTcb
5MBqaI9xFKNQyJB7729xaNAKpOvgJlgc6hHBWSlnk2JmvnVjFexnaviPFVl0tc6t
yMZkccona1d6Jwzgfp8UvYHTPda8g0SGTKur4BDij/ecNh7rW+DVri7Fw7IHcAO3
ssb1nEMMSYid9LZEpI5+Yf0Etwji9kevTMeLR+zZwQyHDHhJSkOa8LY07W1lc5fc
111pyt/26N8ae/zF8Z32rOfl1cN+dx7CQGlIkzJMTgus8n7kk+sUWzjnFvoqqQ==
-----END CERTIFICATE-----