(CAT-2007) Set http_mode to VERIFY_PEER

puppetlabs · Sep 16, 2024 · a7600c2 · a7600c2
1 parent afeb5aa
commit a7600c2
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/lib/pdk/util/vendored_file.rb b/lib/pdk/util/vendored_file.rb
@@ -51,8 +51,13 @@ def download_file
         uri = URI.parse(url)
         http = Net::HTTP.new(uri.host, uri.port)
         http.use_ssl = true
-        # TODO: Get rid of this
-        http.verify_mode = OpenSSL::SSL::VERIFY_NONE if Gem.win_platform?
+        http.ssl_version = :TLSv1_2
+        http.ca_file = @config['ssl-ca-cert']
+        http.cert = OpenSSL::X509::Certificate.new(ssl_cert)
+        http.key = OpenSSL::PKey::RSA.new(ssl_key)
+        http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+        http.open_timeout = @config['file-server-conn-timeout']
+
         request = Net::HTTP::Get.new(uri.request_uri)
         response = http.request(request)