Trust the estate CA when fetching ENC facts #529

Merged

benvin merged 1 commits from benvin/enc-facts-ca-bundle into develop

2026-09-20 23:32:19 +10:00

Author	SHA1	Message	Date
unkin-agent	7f66dfd593	Trust the estate CA when fetching ENC data from encapi ci/woodpecker/pr/ruby-validate Pipeline was successful Details ci/woodpecker/pr/puppet-lint Pipeline was successful Details ci/woodpecker/pr/bolt-validate Pipeline was successful Details ci/woodpecker/pr/yamllint Pipeline was successful Details ci/woodpecker/pr/erb-validate Pipeline was successful Details ci/woodpecker/pr/epp-validate Pipeline was successful Details ci/woodpecker/pr/ruby-check Pipeline was successful Details ci/woodpecker/pr/puppet-validate Pipeline was successful Details Facter runs under Puppet's vendored ruby, whose OpenSSL trusts only /opt/puppetlabs/puppet/ssl/cert.pem, not the system trust store, so every node failed encapi TLS with 'unable to get local issuer certificate'. Point Net::HTTP at the CA anchor profiles::pki::vaultca installs and keep VERIFY_PEER on.	2026-09-20 23:20:15 +10:00