{"record":{"id":"46d3da7e8ec2c9db","repo":"puppetlabs/puppet","slug":"the-client-certificate-is-missing-from-path","errorCode":null,"errorMessage":"The client certificate is missing from '%{path}'","messagePattern":"The client certificate is missing from '%(.+?)'","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/x509/cert_provider.rb","lineNumber":280,"sourceCode":"    save_pem(cert.to_pem, path, **permissions_for_setting(:hostcert))\n  rescue SystemCallError => e\n    raise Puppet::Error.new(_(\"Failed to save client certificate for '%{name}'\") % { name: name }, e)\n  end\n\n  # Load a named client cert from the configured `certdir`.\n  #\n  # @param name [String] The client cert identity\n  # @param required [Boolean] If true, raise it is missing\n  # @return (see #load_request_from_pem)\n  # @raise (see #load_client_cert_from_pem)\n  # @raise [Puppet::Error] if the client cert cannot be loaded\n  #\n  # @api private\n  def load_client_cert(name, required: false)\n    path = @hostcert || to_path(@certdir, name)\n    pem = load_pem(path)\n    if !pem && required\n      raise Puppet::Error, _(\"The client certificate is missing from '%{path}'\") % { path: path }\n    end\n\n    pem ? load_client_cert_from_pem(pem) : nil\n  rescue SystemCallError => e\n    raise Puppet::Error.new(_(\"Failed to load client certificate for '%{name}'\") % { name: name }, e)\n  end\n\n  # Load a PEM encoded certificate.\n  #\n  # @param pem [String] PEM encoded cert\n  # @return [OpenSSL::X509::Certificate] the certificate\n  # @raise [OpenSSL::X509::CertificateError] The `pem` text does not contain a valid cert\n  #\n  # @api private\n  def load_client_cert_from_pem(pem)\n    OpenSSL::X509::Certificate.new(pem)\n  end\n","sourceCodeStart":262,"sourceCodeEnd":298,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/x509/cert_provider.rb#L262-L298","documentation":"CertProvider#load_client_cert raises Puppet::Error when required is true and the host certificate file is absent: @hostcert, default certdir/<certname>.pem. The node has a key and CA but no signed certificate, which typically means the CSR has not been signed or the cert has not been fetched yet.","triggerScenarios":"SSLProvider#load_context on a node whose certificate was never signed/downloaded; certname mismatch so certdir/<name>.pem does not exist for the current identity; hostcert setting pointing at a custom path that no longer exists.","commonSituations":"New node waiting on manual CA signing or autosign rules that rejected it; cert files cleaned on the node; certname changed after enrollment; cert expired and removed without re-enrollment.","solutions":["Check `puppet config print certname hostcert` and verify the file exists","On the CA: `puppetserver ca list` to see the pending request, then `puppetserver ca sign --certname <name>`","On the node run `puppet agent -t` to submit the CSR or fetch the signed certificate","If certname is wrong, restore the original certname setting","If no CSR exists anywhere, remove leftover cert files and re-enroll from scratch"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"cert = Puppet[:hostcert] || File.join(Puppet[:certdir], \"#{Puppet[:certname]}.pem\")\nraise \"client cert missing at #{cert} — is the CSR signed?\" unless File.size?(cert)","typeGuard":null,"tryCatchPattern":"begin\n  cert = provider.load_client_cert(name, required: true)\nrescue Puppet::Error => e\n  wait_for_ca_sign(name)   # poll `puppetserver ca list`, then `puppet agent -t` to fetch\n  cert = provider.load_client_cert(name, required: true)\nend","preventionTips":["Use a wait-for-certificate loop in provisioning before starting services that need TLS","Monitor pending CSRs on the CA so enrollment stalls are visible","Keep certname stable across reboots and clones"],"tags":["ruby","puppet","ssl","x509","client-certificate","pki"],"backgroundTag":"missing-client-certificate","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}