{"record":{"id":"69083cb75d558de1","repo":"puppetlabs/puppet","slug":"run-puppet-agent-t","errorCode":null,"errorMessage":"Run `puppet agent -t`","messagePattern":"Run `puppet agent -t`","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/puppet/http/client.rb","lineNumber":322,"sourceCode":"  def close\n    @pool.close\n    @default_ssl_context = nil\n    @default_system_ssl_context = nil\n  end\n\n  def default_ssl_context\n    cert = Puppet::X509::CertProvider.new\n    password = cert.load_private_key_password\n\n    ssl = Puppet::SSL::SSLProvider.new\n    ctx = ssl.load_context(certname: Puppet[:certname], password: password)\n    ssl.print(ctx)\n    ctx\n  rescue => e\n    # TRANSLATORS: `message` is an already translated string of why SSL failed to initialize\n    Puppet.log_exception(e, _(\"Failed to initialize SSL: %{message}\") % { message: e.message })\n    # TRANSLATORS: `puppet agent -t` is a command and should not be translated\n    Puppet.err(_(\"Run `puppet agent -t`\"))\n    raise e\n  end\n\n  protected\n\n  def encode_query(url, params)\n    return url if params.empty?\n\n    url = url.dup\n    url.query = encode_params(params)\n    url\n  end\n\n  private\n\n  # Connect or borrow a connection from the pool to the host and port associated\n  # with the request's URL. Then execute the HTTP request, retrying and\n  # following redirects as needed, and return the HTTP response. The response","sourceCodeStart":304,"sourceCodeEnd":340,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/http/client.rb#L304-L340","documentation":"Printed by Puppet::HTTP::Client#default_ssl_context as the remediation hint after any exception while building the SSL context — missing or unreadable CA, CRL, key, or cert (errors 1120-1125), or a bad key password. The original failure is logged first as 'Failed to initialize SSL: <message>', then this hint, then the exception is re-raised.","triggerScenarios":"Any Puppet::HTTP request path that calls default_ssl_context on a node whose SSL material is incomplete or corrupt; typically the first network touch of puppet agent, puppet ssl, or HTTP API calls after a broken or absent bootstrap.","commonSituations":"Unbootstrapped nodes; lost private keys; mismatched certname; cloned or partially restored ssl dirs; encrypted key password mismatches.","solutions":["Read the preceding 'Failed to initialize SSL:' log line — it carries the root cause","Run `puppet agent -t` (or `puppet ssl provision`) to fetch the missing CA/CRL and submit the CSR","Verify identity files: `puppet config print localcacert hostcrl hostcert hostprivkey` and confirm each exists and is readable","Re-enroll the node if the key or cert is unrecoverable"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"%w[localcacert hostcrl hostcert hostprivkey].each do |setting|\n  path = Puppet[setting]\n  abort \"#{setting} missing or empty at #{path}\" if path && !File.size?(path)\nend","typeGuard":null,"tryCatchPattern":"begin\n  response = Puppet::HTTP::Client.new.get(uri)\nrescue StandardError => e\n  warn 'SSL not provisioned — run `puppet agent -t` before using HTTP APIs' if ssl_related?(e)\n  raise\nend","preventionTips":["Make SSL provisioning an explicit step before any code uses Puppet::HTTP","Health-check the four identity files (CA, CRL, cert, key) in node readiness scripts","Never prune ssldir contents without a re-provision plan"],"tags":["ruby","puppet","ssl","bootstrap","http-client","provisioning"],"backgroundTag":"ssl-initialization-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}