{"record":{"id":"52f07522f0dce945","repo":"puppetlabs/puppet","slug":"the-csr-for-host-name-does-not-match-the-publ","errorCode":null,"errorMessage":"The CSR for host '%{name}' does not match the public key","messagePattern":"The CSR for host '%(.+?)' does not match the public key","errorType":"exception","errorClass":"Puppet::SSL::SSLError","httpStatus":null,"severity":"error","filePath":"lib/puppet/ssl/ssl_provider.rb","lineNumber":208,"sourceCode":"    client_cert = cert.load_client_cert(certname, required: true)\n\n    create_context(cacerts: cacerts, crls: crls,  private_key: private_key, client_cert: client_cert, revocation: revocation, include_system_store: include_system_store)\n  rescue OpenSSL::PKey::PKeyError => e\n    raise Puppet::SSL::SSLError.new(_(\"Failed to load private key for host '%{name}': %{message}\") % { name: certname, message: e.message }, e)\n  end\n\n  # Verify the `csr` was signed with a private key corresponding to the\n  # `public_key`. This ensures the CSR was signed by someone in possession\n  # of the private key, and that it hasn't been tampered with since.\n  #\n  # @param csr [OpenSSL::X509::Request] certificate signing request\n  # @param public_key [OpenSSL::PKey::RSA, OpenSSL::PKey::EC] public key\n  # @raise [Puppet::SSL:SSLError] The private_key for the given `public_key` was\n  #   not used to sign the CSR.\n  # @api private\n  def verify_request(csr, public_key)\n    unless csr.verify(public_key)\n      raise Puppet::SSL::SSLError, _(\"The CSR for host '%{name}' does not match the public key\") % { name: subject(csr) }\n    end\n\n    csr\n  end\n\n  def print(ssl_context, alg = 'SHA256')\n    if Puppet::Util::Log.sendlevel?(:debug)\n      chain = ssl_context.client_chain\n      # print from root to client\n      chain.reverse.each_with_index do |cert, i|\n        digest = Puppet::SSL::Digest.new(alg, cert.to_der)\n        if i == chain.length - 1\n          Puppet.debug(_(\"Verified client certificate '%{subject}' fingerprint %{digest}\") % { subject: cert.subject.to_utf8, digest: digest })\n        else\n          Puppet.debug(_(\"Verified CA certificate '%{subject}' fingerprint %{digest}\") % { subject: cert.subject.to_utf8, digest: digest })\n        end\n      end\n      ssl_context.crls.each do |crl|","sourceCodeStart":190,"sourceCodeEnd":226,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/ssl/ssl_provider.rb#L190-L226","documentation":"Error \"The CSR for host '%{name}' does not match the public key\" thrown in puppetlabs/puppet.","triggerScenarios":"Thrown at lib/puppet/ssl/ssl_provider.rb:208 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}