{"record":{"id":"551de2316ddb5e4b","repo":"puppetlabs/puppet","slug":"the-certificate-for-name-has-not-yet-been-sig","errorCode":null,"errorMessage":"The certificate for '%{name}' has not yet been signed","messagePattern":"The certificate for '%(.+?)' has not yet been signed","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/application/ssl.rb","lineNumber":143,"sourceCode":"    Puppet::SSL::Oids.register_puppet_oids\n    Puppet::SSL::Oids.load_custom_oid_file(Puppet[:trusted_oid_mapping_file])\n\n    certname = Puppet[:certname]\n    action = command_line.args.first\n    case action\n    when 'submit_request'\n      ssl_context = @machine.ensure_ca_certificates\n      if submit_request(ssl_context)\n        cert = download_cert(ssl_context)\n        unless cert\n          Puppet.info(_(\"The certificate for '%{name}' has not yet been signed\") % { name: certname })\n        end\n      end\n    when 'download_cert'\n      ssl_context = @machine.ensure_ca_certificates\n      cert = download_cert(ssl_context)\n      unless cert\n        raise Puppet::Error, _(\"The certificate for '%{name}' has not yet been signed\") % { name: certname }\n      end\n    when 'generate_request'\n      generate_request(certname)\n    when 'verify'\n      verify(certname)\n    when 'clean'\n      possible_extra_args = command_line.args.drop(1)\n      unless possible_extra_args.empty?\n        raise Puppet::Error, _(<<~END) % { args: possible_extra_args.join(' ') }\n          Extra arguments detected: %{args}\n          Did you mean to run:\n            puppetserver ca clean --certname <name>\n          Or:\n            puppet ssl clean --target <name>\n        END\n      end\n\n      clean(certname)","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/application/ssl.rb#L125-L161","documentation":"During 'puppet ssl download_cert', if the CA returns no certificate for the node's certname, Puppet::Error is raised: the CSR exists but has not been signed yet. The submit_request path prints the same text only as an info message (Puppet.info), because waiting is normal right after submitting.","triggerScenarios":"Fresh node: ran submit_request (or the first phase of bootstrap) with autosigning disabled, then ran download_cert before a CA operator signed the CSR; the agent's certname differs from the pending CSR so the CA has nothing to return.","commonSituations":"New agents onboarding without autosign.conf entries; CI containers generating new certnames each run; the certificate cleaned/revoked on the CA between request and download.","solutions":["Sign on the CA: puppetserver ca list, then puppetserver ca sign --certname <name>, and re-run puppet ssl download_cert (or bootstrap)","Confirm the agent's certname matches the pending CSR: puppet config print certname","If autosigning is intended, add the certname/pattern to the CA's autosign.conf and resubmit","Verify the result afterwards with puppet ssl verify"],"exampleFix":"# on the CA node\npuppetserver ca list\npuppetserver ca sign --certname agent.example.com\n\n# on the agent\npuppet ssl bootstrap","handlingStrategy":"retry","validationCode":"# before forcing a download, check the CA side\nsigned = system('puppetserver ca list --signed --certname agent.example.com') # run where CA access exists\ndownload_cert if signed","typeGuard":null,"tryCatchPattern":"tries = 0\nbegin\n  tries += 1\n  run('puppet ssl download_cert')\nrescue Puppet::Error => e\n  raise if tries >= 30 || e.message !~ /not yet been signed/\n  sleep(60) # wait for CA operator to sign, then retry\n  retry\nend","preventionTips":["Use 'puppet ssl bootstrap' — it sequences submit_request/download_cert correctly","Add expected certname patterns to autosign.conf for ephemeral/CI nodes","After signing on the CA, verify with 'puppet ssl verify' before relying on the cert"],"tags":["ssl","certificate","ca","puppet"],"backgroundTag":"certificate-not-signed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}