(#16769) Fix header too long error with ExportCertData

[jeffmccune]

Without this patch new Puppet agent nodes who do not yet have a signed
certificate will receive this error message when Apache is configured with
the +ExportCertData option.

Error: Could not request certificate: Error 400 on SERVER: header too long
Exiting; failed to retrieve certificate and waitforcert is disabled

This is a problem because Puppet doesn't run at all.

The root cause is that we didn't take into account the edge case where a
Puppet agent is operating as an anonymous SSL client without a signed
certificate. In this situation, the SSL_CLIENT_CERT environment
variable is set, but is the empty string.

Worse, the OpenSSL error message is mis-leading because the certificate
is not present rather not "too long."

This patch fixes the problem by explicitly checking if the data is empty
or nil.

[lsgrep]

@jeffmccune
hi Jeff ,is there any workaround for this issue.
updating is not a viable option for me for now.

[jeffmccune]

You could run Apache with the +ExportCertData removed. This will mean you won't be warned as certificates near their expiration date, but everything else should operate normally.

[lsgrep]

thanks for the reply.
I am a newbie .
There is no apache module configured. I am having this problem while trying to setup puppet in my redhat 5 hosts.

[jeffmccune]

On Wed, May 8, 2013 at 8:52 PM, xperian notifications@github.com wrote:

thanks for the reply.
I am a newbie .
There is no apache module configured. I am having this problem while
trying to setup puppet in my redhat 5 hosts.

Ah, I understand. If you need some documentation on setting up Puppet with
Apache, I recommend downloading a copy of Puppet Enterprise. It's free up
to 10 nodes, and a great way to get started quickly. You could refer to it
to see how Apache is configured if you decide it's not a good fit for you.
There are also detailed instructions on how to setup Puppet with Apache on
EL5 systems in the Pro Puppet book. Finally, there are some reference
notes in the ext/ directory of the source on github. Check out the
config.ru file.

Hope this helps,
-Jeff