The puppet module does not validate the master's X.509 certificate

[gunnarbeutner]

The puppet module fetches the master's certificate using the icinga2 pki save-cert CLI command but does not in any way validate that this certificate actually belongs to the correct Icinga master.

This presents an MITM vulnerability where an attacker could associate Icinga agents with a rogue Icinga master. Once that's done it can:

a) Retrieve check results from the agent
b) send commands to the agent (depending on whether accept_commands is set)
c) send config files to the agent (depending on whether accept_config is set).

[bobapple]

references #365

[lbetz]

Add an optional parameter to check the fingerprint and/or compare the trusted certificate with the parent cert.

[lbetz]

The fingerprint ends with one or more whitespaces.

On Windows use
| findstr /R /C:"...[ ]*$"

On nix use
| grep "...\s$"