{"record":{"id":"8ec9362bcf4b54ff","repo":"puppetlabs/puppet","slug":"cannot-specify-csr-attribute-oid-conflicts-wit","errorCode":null,"errorMessage":"Cannot specify CSR attribute %{oid}: conflicts with internally used CSR attribute","messagePattern":"Cannot specify CSR attribute %(.+?): conflicts with internally used CSR attribute","errorType":"exception","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"lib/puppet/ssl/certificate_request.rb","lineNumber":218,"sourceCode":"    end\n  end\n\n  private\n\n  # Exclude OIDs that may conflict with how Puppet creates CSRs.\n  #\n  # We only have nominal support for Microsoft extension requests, but since we\n  # ultimately respect that field when looking for extension requests in a CSR\n  # we need to prevent that field from being written to directly.\n  PRIVATE_CSR_ATTRIBUTES = [\n    'extReq',   '1.2.840.113549.1.9.14',\n    'msExtReq', '1.3.6.1.4.1.311.2.1.14'\n  ]\n\n  def add_csr_attributes(csr, csr_attributes)\n    csr_attributes.each do |oid, value|\n      if PRIVATE_CSR_ATTRIBUTES.include? oid\n        raise ArgumentError, _(\"Cannot specify CSR attribute %{oid}: conflicts with internally used CSR attribute\") % { oid: oid }\n      end\n\n      encoded = OpenSSL::ASN1::PrintableString.new(value.to_s)\n\n      attr_set = OpenSSL::ASN1::Set.new([encoded])\n      csr.add_attribute(OpenSSL::X509::Attribute.new(oid, attr_set))\n      Puppet.debug(\"Added csr attribute: #{oid} => #{attr_set.inspect}\")\n    rescue OpenSSL::X509::AttributeError => e\n      raise Puppet::Error, _(\"Cannot create CSR with attribute %{oid}: %{message}\") % { oid: oid, message: e.message }, e.backtrace\n    end\n  end\n\n  PRIVATE_EXTENSIONS = [\n    'subjectAltName', '2.5.29.17'\n  ]\n\n  # @api private\n  def extension_request_attribute(options)","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/ssl/certificate_request.rb#L200-L236","documentation":"Error \"Cannot specify CSR attribute %{oid}: conflicts with internally used CSR attribute\" thrown in puppetlabs/puppet.","triggerScenarios":"Thrown at lib/puppet/ssl/certificate_request.rb:218 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}