Merge lp:~axwalk/juju-core/1225916-httpstroage-authentication into lp:~go-bot/juju-core/trunk

[Andrew Wilkins]

environs/httpstorage: authentication support

This change to httpstorage enables authentication,
where authentication implies authorisation.
For an authenticating httpstorage, authentication
is required only for Put/Remove* methods; List/Get
will work unauthenticated.

Authentication is implemented by a client providing
a certificate signed by the CA, where the CA is
previously agreed upon.

There will be a followup branch which enables this
for the null provider, via additions to the
worker/localstorage.LocalStorageConfig interface,
and storage CA certificate generation at bootstrap
time.

NOTE: one caveat is that wget et al. will need to
skip certificate validation.

Fixes #1225916

https://codereview.appspot.com/13832045/

environs/httpstorage: authentication support

This change to httpstorage enables authentication,
where authentication implies authorisation.
For an authenticating httpstorage, authentication
is required only for Put/Remove* methods; List/Get
will work unauthenticated.

Authentication is implemented by a client providing
a certificate signed by the CA, where the CA is
previously agreed upon.

There will be a followup branch which enables this
for the null provider, via additions to the
worker/localstorage.LocalStorageConfig interface,
and storage CA certificate generation at bootstrap
time.

NOTE: one caveat is that wget et al. will need to
skip certificate validation.

Fixes #1225916

https://codereview.appspot.com/13832045/

[Andrew Wilkins (axwalk)]

Reviewers: mp+187152_code.launchpad.net,

Message:
Please take a look.

Description:
environs/httpstorage: authentication support

This change to httpstorage enables authentication,
where authentication implies authorisation.
For an authenticating httpstorage, authentication
is required only for Put/Remove* methods; List/Get
will work unauthenticated.

Authentication is implemented by a client providing
a certificate signed by the CA, where the CA is
previously agreed upon.

There will be a followup branch which enables this
for the null provider, via additions to the
worker/localstorage.LocalStorageConfig interface,
and storage CA certificate generation at bootstrap
time.

NOTE: one caveat is that wget et al. will need to
skip certificate validation.

Fixes #1225916

https://code.launchpad.net/~axwalk/juju-core/1225916-httpstroage-authentication/+merge/187152

(do not edit description out of merge proposal)

Please review this at https://codereview.appspot.com/13832045/

[William Reade (fwereade)]

message: Lovely; LGTM. It makes me think a bit though: AFAIR the only
clients that need authentication will be the CLI and the manager nodes,
and both of those do already have suitable storage-manipulation
pathways.

So, if cert distribution proves to be a hassle, we can in fact fall back
to other storage mechanisms without losing functionality (and we still
get the security we care about). Handy if we need it.

https://codereview.appspot.com/13832045/

[Andrew Wilkins (axwalk)]

On 2013/09/24 13:33:06, fwereade wrote:
> message: Lovely; LGTM. It makes me think a bit though: AFAIR the only
clients
> that need authentication will be the CLI and the manager nodes, and
both of
> those do already have suitable storage-manipulation pathways.

What do you mean by "suitable storage-manipulation pathways"?

> So, if cert distribution proves to be a hassle, we can in fact fall
back to
> other storage mechanisms without losing functionality (and we still
get the
> security we care about). Handy if we need it.

Not really following. What are the other storage mechanisms that can be
fallen back on?

https://codereview.appspot.com/13832045/

=== modified file 'cert/cert.go'
--- cert/cert.go	2013-08-02 14:04:05 +0000
+++ cert/cert.go	2013-09-25 02:37:59 +0000
@@ -14,6 +14,7 @@
 	"errors"
 	"fmt"
 	"math/big"
+	"net"
 	"time"
 )
 
@@ -114,9 +115,18 @@
 	return certPEM, keyPEM, nil
 }
 
-// NewServer generates a certificate/key pair suitable for use by a
-// server for an environment with the given name.
-func NewServer(envName string, caCertPEM, caKeyPEM []byte, expiry time.Time) (certPEM, keyPEM []byte, err error) {
+// NewServer generates a certificate/key pair suitable for use by a server.
+func NewServer(caCertPEM, caKeyPEM []byte, expiry time.Time, hostnames []string) (certPEM, keyPEM []byte, err error) {
+	return newLeaf(caCertPEM, caKeyPEM, expiry, hostnames, nil)
+}
+
+// NewClient generates a certificate/key pair suitable for client authentication.
+func NewClient(caCertPEM, caKeyPEM []byte, expiry time.Time) (certPEM, keyPEM []byte, err error) {
+	return newLeaf(caCertPEM, caKeyPEM, expiry, nil, []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth})
+}
+
+// newLeaf generates a certificate/key pair suitable for use by a leaf node.
+func newLeaf(caCertPEM, caKeyPEM []byte, expiry time.Time, hostnames []string, extKeyUsage []x509.ExtKeyUsage) (certPEM, keyPEM []byte, err error) {
 	tlsCert, err := tls.X509KeyPair(caCertPEM, caKeyPEM)
 	if err != nil {
 		return nil, nil, err
@@ -153,6 +163,14 @@
 
 		SubjectKeyId: bigIntHash(key.N),
 		KeyUsage:     x509.KeyUsageDataEncipherment,
+		ExtKeyUsage:  extKeyUsage,
+	}
+	for _, hostname := range hostnames {
+		if ip := net.ParseIP(hostname); ip != nil {
+			template.IPAddresses = append(template.IPAddresses, ip)
+		} else {
+			template.DNSNames = append(template.DNSNames, hostname)
+		}
 	}
 	certDER, err := x509.CreateCertificate(rand.Reader, template, caCert, &key.PublicKey, caKey)
 	if err != nil {

=== modified file 'cert/cert_test.go'
--- cert/cert_test.go	2013-09-13 14:48:13 +0000
+++ cert/cert_test.go	2013-09-25 02:37:59 +0000
@@ -76,12 +76,12 @@
 	caCert, _, err := cert.ParseCertAndKey(caCertPEM, caKeyPEM)
 	c.Assert(err, gc.IsNil)
 
-	srvCertPEM, srvKeyPEM, err := cert.NewServer("juju test", caCertPEM, caKeyPEM, expiry)
+	var noHostnames []string
+	srvCertPEM, srvKeyPEM, err := cert.NewServer(caCertPEM, caKeyPEM, expiry, noHostnames)
 	c.Assert(err, gc.IsNil)
 
 	srvCert, srvKey, err := cert.ParseCertAndKey(srvCertPEM, srvKeyPEM)
 	c.Assert(err, gc.IsNil)
-	c.Assert(err, gc.IsNil)
 	c.Assert(srvCert.Subject.CommonName, gc.Equals, "*")
 	c.Assert(srvCert.NotAfter.Equal(expiry), gc.Equals, true)
 	c.Assert(srvCert.BasicConstraintsValid, gc.Equals, false)
@@ -90,6 +90,41 @@
 	checkTLSConnection(c, caCert, srvCert, srvKey)
 }
 
+func (certSuite) TestNewServerHostnames(c *gc.C) {
+	type test struct {
+		hostnames           []string
+		expectedDNSNames    []string
+		expectedIPAddresses []net.IP
+	}
+	tests := []test{{
+		[]string{},
+		nil,
+		nil,
+	}, {
+		[]string{"example.com"},
+		[]string{"example.com"},
+		nil,
+	}, {
+		[]string{"example.com", "127.0.0.1"},
+		[]string{"example.com"},
+		[]net.IP{net.IPv4(127, 0, 0, 1).To4()},
+	}, {
+		[]string{"::1"},
+		nil,
+		[]net.IP{net.IPv6loopback},
+	}}
+	for i, t := range tests {
+		c.Logf("test %d: %v", i, t.hostnames)
+		expiry := roundTime(time.Now().AddDate(1, 0, 0))
+		srvCertPEM, srvKeyPEM, err := cert.NewServer(caCertPEM, caKeyPEM, expiry, t.hostnames)
+		c.Assert(err, gc.IsNil)
+		srvCert, _, err := cert.ParseCertAndKey(srvCertPEM, srvKeyPEM)
+		c.Assert(err, gc.IsNil)
+		c.Assert(srvCert.DNSNames, gc.DeepEquals, t.expectedDNSNames)
+		c.Assert(srvCert.IPAddresses, gc.DeepEquals, t.expectedIPAddresses)
+	}
+}
+
 func (certSuite) TestWithNonUTCExpiry(c *gc.C) {
 	expiry, err := time.Parse("2006-01-02 15:04:05.999999999 -0700 MST", "2012-11-28 15:53:57 +0100 CET")
 	c.Assert(err, gc.IsNil)
@@ -98,14 +133,16 @@
 	c.Assert(err, gc.IsNil)
 	c.Assert(xcert.NotAfter.Equal(expiry), gc.Equals, true)
 
-	certPEM, _, err = cert.NewServer("foo", certPEM, keyPEM, expiry)
+	var noHostnames []string
+	certPEM, _, err = cert.NewServer(certPEM, keyPEM, expiry, noHostnames)
 	xcert, err = cert.ParseCert(certPEM)
 	c.Assert(err, gc.IsNil)
 	c.Assert(xcert.NotAfter.Equal(expiry), gc.Equals, true)
 }
 
 func (certSuite) TestNewServerWithInvalidCert(c *gc.C) {
-	srvCert, srvKey, err := cert.NewServer("foo", nonCACert, nonCAKey, time.Now())
+	var noHostnames []string
+	srvCert, srvKey, err := cert.NewServer(nonCACert, nonCAKey, time.Now(), noHostnames)
 	c.Check(srvCert, gc.IsNil)
 	c.Check(srvKey, gc.IsNil)
 	c.Assert(err, gc.ErrorMatches, "CA certificate is not a valid CA")
@@ -116,7 +153,8 @@
 	caCert, caKey, err := cert.NewCA("foo", now.Add(1*time.Minute))
 	c.Assert(err, gc.IsNil)
 
-	srvCert, _, err := cert.NewServer("foo", caCert, caKey, now.Add(3*time.Minute))
+	var noHostnames []string
+	srvCert, _, err := cert.NewServer(caCert, caKey, now.Add(3*time.Minute), noHostnames)
 	c.Assert(err, gc.IsNil)
 
 	err = cert.Verify(srvCert, caCert, now)
@@ -139,7 +177,7 @@
 	err = cert.Verify(srvCert, caCert2, now)
 	c.Check(err, gc.ErrorMatches, "x509: certificate signed by unknown authority")
 
-	srvCert2, _, err := cert.NewServer("bar", caCert2, caKey2, now.Add(1*time.Minute))
+	srvCert2, _, err := cert.NewServer(caCert2, caKey2, now.Add(1*time.Minute), noHostnames)
 	c.Assert(err, gc.IsNil)
 
 	// Check new server certificate against original CA.

=== modified file 'environs/config/config.go'
--- environs/config/config.go	2013-09-13 01:30:21 +0000
+++ environs/config/config.go	2013-09-25 02:37:59 +0000
@@ -610,5 +610,6 @@
 	if !hasCAKey {
 		return nil, nil, fmt.Errorf("environment configuration has no ca-private-key")
 	}
-	return cert.NewServer(cfg.Name(), caCert, caKey, time.Now().UTC().AddDate(10, 0, 0))
+	var noHostnames []string
+	return cert.NewServer(caCert, caKey, time.Now().UTC().AddDate(10, 0, 0), noHostnames)
 }

=== modified file 'environs/httpstorage/backend.go'
--- environs/httpstorage/backend.go	2013-09-19 00:22:15 +0000
+++ environs/httpstorage/backend.go	2013-09-25 02:37:59 +0000
@@ -4,12 +4,17 @@
 package httpstorage
 
 import (
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
 	"fmt"
 	"io/ioutil"
 	"net"
 	"net/http"
 	"strings"
+	"time"
 
+	"launchpad.net/juju-core/cert"
 	"launchpad.net/juju-core/environs/storage"
 )
 
@@ -19,6 +24,7 @@
 // storageBackend provides HTTP access to a storage object.
 type storageBackend struct {
 	backend storage.Storage
+	tls     bool
 }
 
 // ServeHTTP handles the HTTP requests to the container.
@@ -39,6 +45,13 @@
 	}
 }
 
+// authorised checks that either the storage does not require authorisation,
+// or the user has negotiated TLS with a valid certificate. Authentication
+// implies authorisation.
+func (s *storageBackend) authorised(req *http.Request) bool {
+	return !s.tls || len(req.TLS.PeerCertificates) > 0
+}
+
 // handleGet returns a storage file to the client.
 func (s *storageBackend) handleGet(w http.ResponseWriter, req *http.Request) {
 	readcloser, err := s.backend.Get(req.URL.Path[1:])
@@ -72,6 +85,10 @@
 
 // handlePut stores data from the client in the storage.
 func (s *storageBackend) handlePut(w http.ResponseWriter, req *http.Request) {
+	if !s.authorised(req) {
+		http.Error(w, "unauthorised access", http.StatusUnauthorized)
+		return
+	}
 	if req.ContentLength < 0 {
 		http.Error(w, "missing or invalid Content-Length header", http.StatusInternalServerError)
 		return
@@ -86,6 +103,10 @@
 
 // handleDelete removes a file from the storage.
 func (s *storageBackend) handleDelete(w http.ResponseWriter, req *http.Request) {
+	if !s.authorised(req) {
+		http.Error(w, "unauthorised access", http.StatusUnauthorized)
+		return
+	}
 	err := s.backend.Remove(req.URL.Path[1:])
 	if err != nil {
 		http.Error(w, fmt.Sprint(err), http.StatusInternalServerError)
@@ -98,11 +119,50 @@
 // requests to the given storage implementation. It returns the network
 // listener. This can then be attached to with Client.
 func Serve(addr string, stor storage.Storage) (net.Listener, error) {
-	backend := &storageBackend{backend: stor}
+	return serve(addr, stor, nil)
+}
+
+// ServeTLS runs a storage server on the given network address, relaying
+// requests to the given storage implementation. The server runs a TLS
+// listener, and verifies client certificates (if given) against the
+// specified CA certificate. A client certificate is only required for
+// PUT and DELETE methods.
+//
+// This method returns the network listener, which can then be attached
+// to with ClientTLS.
+func ServeTLS(addr string, stor storage.Storage, caCertPEM, caKeyPEM []byte, hostnames []string) (net.Listener, error) {
+	expiry := time.Now().UTC().AddDate(10, 0, 0)
+	certPEM, keyPEM, err := cert.NewServer(caCertPEM, caKeyPEM, expiry, hostnames)
+	if err != nil {
+		return nil, err
+	}
+	serverCert, err := tls.X509KeyPair(certPEM, keyPEM)
+	if err != nil {
+		return nil, err
+	}
+	caCerts := x509.NewCertPool()
+	if !caCerts.AppendCertsFromPEM(caCertPEM) {
+		return nil, errors.New("error adding CA certificate to pool")
+	}
+	config := &tls.Config{
+		NextProtos:   []string{"http/1.1"},
+		Certificates: []tls.Certificate{serverCert},
+		ClientAuth:   tls.VerifyClientCertIfGiven,
+		ClientCAs:    caCerts,
+	}
+	return serve(addr, stor, config)
+}
+
+func serve(addr string, stor storage.Storage, tlsConfig *tls.Config) (net.Listener, error) {
 	listener, err := net.Listen("tcp", addr)
 	if err != nil {
 		return nil, fmt.Errorf("cannot start listener: %v", err)
 	}
+	backend := &storageBackend{backend: stor}
+	if tlsConfig != nil {
+		listener = tls.NewListener(listener, tlsConfig)
+		backend.tls = true
+	}
 	mux := http.NewServeMux()
 	mux.Handle("/", backend)
 	go http.Serve(listener, mux)

=== modified file 'environs/httpstorage/backend_test.go'
--- environs/httpstorage/backend_test.go	2013-09-20 02:53:59 +0000
+++ environs/httpstorage/backend_test.go	2013-09-25 02:37:59 +0000
@@ -5,6 +5,8 @@
 
 import (
 	"bytes"
+	"crypto/tls"
+	"crypto/x509"
 	"fmt"
 	"io/ioutil"
 	"net"
@@ -18,6 +20,8 @@
 
 	"launchpad.net/juju-core/environs/filestorage"
 	"launchpad.net/juju-core/environs/httpstorage"
+	coretesting "launchpad.net/juju-core/testing"
+	jc "launchpad.net/juju-core/testing/checkers"
 	"launchpad.net/juju-core/testing/testbase"
 )
 
@@ -43,6 +47,19 @@
 	return listener, fmt.Sprintf("http://%s/", listener.Addr()), dataDir
 }
 
+// startServerTLS starts a new TLS-based local storage server
+// using a temporary directory and returns the listener,
+// a base URL for the server and the directory path.
+func startServerTLS(c *gc.C, caCertPEM, caKeyPEM []byte) (listener net.Listener, url, dataDir string) {
+	dataDir = c.MkDir()
+	embedded, err := filestorage.NewFileStorageWriter(dataDir, filestorage.UseDefaultTmpDir)
+	c.Assert(err, gc.IsNil)
+	hostnames := []string{"127.0.0.1"}
+	listener, err = httpstorage.ServeTLS("127.0.0.1:0", embedded, caCertPEM, caKeyPEM, hostnames)
+	c.Assert(err, gc.IsNil)
+	return listener, fmt.Sprintf("https://%s/", listener.Addr()), dataDir
+}
+
 type testCase struct {
 	name    string
 	content string
@@ -118,9 +135,12 @@
 	listener, url, dataDir := startServer(c)
 	defer listener.Close()
 	createTestData(c, dataDir)
+	testGet(c, http.DefaultClient, url)
+}
 
+func testGet(c *gc.C, client *http.Client, url string) {
 	check := func(tc testCase) {
-		resp, err := http.Get(url + tc.name)
+		resp, err := client.Get(url + tc.name)
 		c.Assert(err, gc.IsNil)
 		if tc.status != 0 {
 			c.Assert(resp.StatusCode, gc.Equals, tc.status)
@@ -188,11 +208,13 @@
 	// Test listing file of a storage.
 	listener, url, dataDir := startServer(c)
 	defer listener.Close()
-
 	createTestData(c, dataDir)
+	testList(c, http.DefaultClient, url)
+}
 
+func testList(c *gc.C, client *http.Client, url string) {
 	check := func(tc testCase) {
-		resp, err := http.Get(url + tc.name + "*")
+		resp, err := client.Get(url + tc.name + "*")
 		c.Assert(err, gc.IsNil)
 		if tc.status != 0 {
 			c.Assert(resp.StatusCode, gc.Equals, tc.status)
@@ -235,20 +257,25 @@
 	// Test sending a file to the storage.
 	listener, url, dataDir := startServer(c)
 	defer listener.Close()
-
 	createTestData(c, dataDir)
+	testPut(c, http.DefaultClient, url, dataDir, true)
+}
 
+func testPut(c *gc.C, client *http.Client, url, dataDir string, authorised bool) {
 	check := func(tc testCase) {
 		req, err := http.NewRequest("PUT", url+tc.name, bytes.NewBufferString(tc.content))
 		c.Assert(err, gc.IsNil)
 		req.Header.Set("Content-Type", "application/octet-stream")
-		resp, err := http.DefaultClient.Do(req)
+		resp, err := client.Do(req)
 		c.Assert(err, gc.IsNil)
 		if tc.status != 0 {
 			c.Assert(resp.StatusCode, gc.Equals, tc.status)
 			return
+		} else if !authorised {
+			c.Assert(resp.StatusCode, gc.Equals, http.StatusUnauthorized)
+			return
 		}
-		c.Assert(resp.StatusCode, gc.Equals, 201)
+		c.Assert(resp.StatusCode, gc.Equals, http.StatusCreated)
 
 		fp := filepath.Join(dataDir, tc.name)
 		b, err := ioutil.ReadFile(fp)
@@ -288,9 +315,11 @@
 	// Test removing a file in the storage.
 	listener, url, dataDir := startServer(c)
 	defer listener.Close()
-
 	createTestData(c, dataDir)
+	testRemove(c, http.DefaultClient, url, dataDir, true)
+}
 
+func testRemove(c *gc.C, client *http.Client, url, dataDir string, authorised bool) {
 	check := func(tc testCase) {
 		fp := filepath.Join(dataDir, tc.name)
 		dir, _ := filepath.Split(fp)
@@ -301,11 +330,14 @@
 
 		req, err := http.NewRequest("DELETE", url+tc.name, nil)
 		c.Assert(err, gc.IsNil)
-		resp, err := http.DefaultClient.Do(req)
+		resp, err := client.Do(req)
 		c.Assert(err, gc.IsNil)
 		if tc.status != 0 {
 			c.Assert(resp.StatusCode, gc.Equals, tc.status)
 			return
+		} else if !authorised {
+			c.Assert(resp.StatusCode, gc.Equals, http.StatusUnauthorized)
+			return
 		}
 		c.Assert(resp.StatusCode, gc.Equals, http.StatusOK)
 
@@ -339,3 +371,42 @@
 	writeData(innerDir, "barin", "this is inner file 'barin'")
 	writeData(innerDir, "bazin", "this is inner file 'bazin'")
 }
+
+func (b *backendSuite) tlsServerAndClient(c *gc.C) (client *http.Client, url, dataDir string) {
+	caCertPEM := []byte(coretesting.CACert)
+	caKeyPEM := []byte(coretesting.CAKey)
+	listener, url, dataDir := startServerTLS(c, caCertPEM, caKeyPEM)
+	b.AddCleanup(func(*gc.C) { listener.Close() })
+	caCerts := x509.NewCertPool()
+	c.Assert(caCerts.AppendCertsFromPEM(caCertPEM), jc.IsTrue)
+	client = &http.Client{
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{RootCAs: caCerts},
+		},
+	}
+	return client, url, dataDir
+}
+
+func (b *backendSuite) TestTLSUnauthenticatedGet(c *gc.C) {
+	client, url, dataDir := b.tlsServerAndClient(c)
+	createTestData(c, dataDir)
+	testGet(c, client, url)
+}
+
+func (b *backendSuite) TestTLSUnauthenticatedList(c *gc.C) {
+	client, url, dataDir := b.tlsServerAndClient(c)
+	createTestData(c, dataDir)
+	testList(c, client, url)
+}
+
+func (b *backendSuite) TestTLSUnauthenticatedPut(c *gc.C) {
+	client, url, dataDir := b.tlsServerAndClient(c)
+	createTestData(c, dataDir)
+	testPut(c, client, url, dataDir, false)
+}
+
+func (b *backendSuite) TestTLSUnauthenticatedRemove(c *gc.C) {
+	client, url, dataDir := b.tlsServerAndClient(c)
+	createTestData(c, dataDir)
+	testRemove(c, client, url, dataDir, false)
+}

=== modified file 'environs/httpstorage/storage.go'
--- environs/httpstorage/storage.go	2013-09-19 00:22:15 +0000
+++ environs/httpstorage/storage.go	2013-09-25 02:37:59 +0000
@@ -4,29 +4,64 @@
 package httpstorage
 
 import (
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
 	"fmt"
 	"io"
 	"io/ioutil"
 	"net/http"
 	"sort"
 	"strings"
+	"time"
 
+	"launchpad.net/juju-core/cert"
 	"launchpad.net/juju-core/environs/storage"
-	"launchpad.net/juju-core/errors"
+	coreerrors "launchpad.net/juju-core/errors"
 	"launchpad.net/juju-core/utils"
 )
 
 // storage implements the storage.Storage interface.
 type localStorage struct {
 	baseURL string
+	client  *http.Client
 }
 
-// Client returns a storage object that will talk to the storage server
-// at the given network address (see Serve)
+// Client returns a storage object that will talk to the
+// storage server at the given network address (see Serve)
 func Client(addr string) storage.Storage {
 	return &localStorage{
 		baseURL: fmt.Sprintf("http://%s/", addr),
-	}
+		client:  http.DefaultClient,
+	}
+}
+
+// ClientTLS returns a storage object that will talk to the
+// storage server at the given network address (see Serve),
+// using TLS. The client will generate a client certificate,
+// signed with the given CA certificate/key, to authenticate.
+func ClientTLS(addr string, caCertPEM, caKeyPEM []byte) (storage.Storage, error) {
+	caCerts := x509.NewCertPool()
+	if !caCerts.AppendCertsFromPEM(caCertPEM) {
+		return nil, errors.New("error adding CA certificate to pool")
+	}
+	expiry := time.Now().UTC().AddDate(10, 0, 0)
+	clientCertPEM, clientKeyPEM, err := cert.NewClient(caCertPEM, caKeyPEM, expiry)
+	clientCert, err := tls.X509KeyPair(clientCertPEM, clientKeyPEM)
+	if err != nil {
+		return nil, err
+	}
+	return &localStorage{
+		baseURL: fmt.Sprintf("https://%s/", addr),
+		client: &http.Client{
+			Transport: &http.Transport{
+				TLSClientConfig: &tls.Config{
+					Certificates: []tls.Certificate{clientCert},
+					RootCAs:      caCerts,
+				},
+			},
+		},
+	}, nil
 }
 
 // Get opens the given storage file and returns a ReadCloser
@@ -38,12 +73,12 @@
 	if err != nil {
 		return nil, err
 	}
-	resp, err := http.Get(url)
+	resp, err := s.client.Get(url)
 	if err != nil {
 		return nil, err
 	}
 	if resp.StatusCode != http.StatusOK {
-		return nil, errors.NotFoundf("file %q", name)
+		return nil, coreerrors.NotFoundf("file %q", name)
 	}
 	return resp.Body, nil
 }
@@ -58,7 +93,7 @@
 	if err != nil {
 		return nil, err
 	}
-	resp, err := http.Get(url + "*")
+	resp, err := s.client.Get(url + "*")
 	if err != nil {
 		return nil, err
 	}
@@ -118,7 +153,7 @@
 	}
 	req.Header.Set("Content-Type", "application/octet-stream")
 	req.ContentLength = length
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := s.client.Do(req)
 	if err != nil {
 		return err
 	}
@@ -140,7 +175,7 @@
 	if err != nil {
 		return err
 	}
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := s.client.Do(req)
 	if err != nil {
 		return err
 	}

=== modified file 'environs/httpstorage/storage_test.go'
--- environs/httpstorage/storage_test.go	2013-09-19 00:22:15 +0000
+++ environs/httpstorage/storage_test.go	2013-09-25 02:37:59 +0000
@@ -9,12 +9,14 @@
 	"io"
 	"io/ioutil"
 	"net/http"
+	"path/filepath"
 
 	gc "launchpad.net/gocheck"
 
 	"launchpad.net/juju-core/environs/httpstorage"
 	"launchpad.net/juju-core/environs/storage"
 	"launchpad.net/juju-core/errors"
+	coretesting "launchpad.net/juju-core/testing"
 	jc "launchpad.net/juju-core/testing/checkers"
 )
 
@@ -22,6 +24,30 @@
 
 var _ = gc.Suite(&storageSuite{})
 
+func (s *storageSuite) TestClientTLS(c *gc.C) {
+	caCertPEM := []byte(coretesting.CACert)
+	caKeyPEM := []byte(coretesting.CAKey)
+
+	listener, _, storageDir := startServerTLS(c, caCertPEM, caKeyPEM)
+	defer listener.Close()
+	stor, err := httpstorage.ClientTLS(listener.Addr().String(), caCertPEM, caKeyPEM)
+	c.Assert(err, gc.IsNil)
+
+	data := []byte("hello")
+	err = ioutil.WriteFile(filepath.Join(storageDir, "filename"), data, 0644)
+	c.Assert(err, gc.IsNil)
+	names, err := storage.List(stor, "filename")
+	c.Assert(err, gc.IsNil)
+	c.Assert(names, gc.DeepEquals, []string{"filename"})
+	checkFileHasContents(c, stor, "filename", data)
+
+	// Now try Put, Remove and RemoveAll.
+	checkPutFile(c, stor, "filenamethesecond", data)
+	checkFileHasContents(c, stor, "filenamethesecond", data)
+	c.Assert(stor.Remove("filenamethesecond"), gc.IsNil)
+	c.Assert(stor.RemoveAll(), gc.IsNil)
+}
+
 func (s *storageSuite) TestList(c *gc.C) {
 	listener, _, _ := startServer(c)
 	defer listener.Close()
@@ -54,6 +80,7 @@
 	storage2 := httpstorage.Client(listener.Addr().String())
 	for _, name := range names {
 		checkFileHasContents(c, storage2, name, []byte(name))
+		checkFileURLHasContents(c, storage2, name, []byte(name))
 	}
 
 	// remove the first file and check that the others remain.
@@ -124,13 +151,15 @@
 	data, err := ioutil.ReadAll(r)
 	c.Check(err, gc.IsNil)
 	c.Check(data, gc.DeepEquals, contents)
+}
 
+func checkFileURLHasContents(c *gc.C, stor storage.StorageReader, name string, contents []byte) {
 	url, err := stor.URL(name)
 	c.Assert(err, gc.IsNil)
 
 	resp, err := http.Get(url)
 	c.Assert(err, gc.IsNil)
-	data, err = ioutil.ReadAll(resp.Body)
+	data, err := ioutil.ReadAll(resp.Body)
 	c.Assert(err, gc.IsNil)
 	defer resp.Body.Close()
 	c.Assert(resp.StatusCode, gc.Equals, http.StatusOK, gc.Commentf("error response: %s", data))

=== modified file 'testing/cert.go'
--- testing/cert.go	2013-07-09 10:32:23 +0000
+++ testing/cert.go	2013-09-25 02:37:59 +0000
@@ -53,7 +53,8 @@
 
 func mustNewServer() (string, string) {
 	cert.KeyBits = 512
-	srvCert, srvKey, err := cert.NewServer("testing-env", []byte(CACert), []byte(CAKey), time.Now().AddDate(10, 0, 0))
+	var hostnames []string
+	srvCert, srvKey, err := cert.NewServer([]byte(CACert), []byte(CAKey), time.Now().AddDate(10, 0, 0), hostnames)
 	if err != nil {
 		panic(err)
 	}