{"record":{"id":"6c19abf135034b29","repo":"puppetlabs/puppet","slug":"the-certificate-for-name-does-not-match-its-p","errorCode":null,"errorMessage":"The certificate for '%{name}' does not match its private key","messagePattern":"The certificate for '%(.+?)' does not match its private key","errorType":"exception","errorClass":"Puppet::SSL::SSLError","httpStatus":null,"severity":"error","filePath":"lib/puppet/ssl/ssl_provider.rb","lineNumber":289,"sourceCode":"    when false\n      0\n    when :leaf\n      OpenSSL::X509::V_FLAG_CRL_CHECK\n    else\n      # :chain is the default\n      OpenSSL::X509::V_FLAG_CRL_CHECK | OpenSSL::X509::V_FLAG_CRL_CHECK_ALL\n    end\n  end\n\n  def resolve_client_chain(store, client_cert, private_key)\n    client_chain = verify_cert_with_store(store, client_cert)\n\n    if !private_key.is_a?(OpenSSL::PKey::RSA) && !private_key.is_a?(OpenSSL::PKey::EC)\n      raise Puppet::SSL::SSLError, _(\"Unsupported key '%{type}'\") % { type: private_key.class.name }\n    end\n\n    unless client_cert.check_private_key(private_key)\n      raise Puppet::SSL::SSLError, _(\"The certificate for '%{name}' does not match its private key\") % { name: subject(client_cert) }\n    end\n\n    client_chain\n  end\n\n  def verify_cert_with_store(store, cert)\n    # StoreContext#initialize accepts a chain argument, but it's set to [] because\n    # puppet requires any intermediate CA certs needed to complete the client's\n    # chain to be in the CA bundle that we downloaded from the server, and\n    # they've already been added to the store. See PUP-9500.\n\n    store_context = OpenSSL::X509::StoreContext.new(store, cert, [])\n    unless store_context.verify\n      current_cert = store_context.current_cert\n\n      # If the client cert's intermediate CA is not in the CA bundle, then warn,\n      # but don't error, because SSL allows the client to send an incomplete\n      # chain, and have the server resolve it.","sourceCodeStart":271,"sourceCodeEnd":307,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/ssl/ssl_provider.rb#L271-L307","documentation":"Error \"The certificate for '%{name}' does not match its private key\" thrown in puppetlabs/puppet.","triggerScenarios":"Thrown at lib/puppet/ssl/ssl_provider.rb:289 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}