{"record":{"id":"ba5344125240e523","repo":"puppetlabs/puppet","slug":"could-not-submit-certificate-request-for-name","errorCode":null,"errorMessage":"Could not submit certificate request for '%{name}' to %{url} due to a conflict on the server","messagePattern":"Could not submit certificate request for '%(.+?)' to %(.+?) due to a conflict on the server","errorType":"exception","errorClass":"Puppet::Error","httpStatus":400,"severity":"error","filePath":"lib/puppet/application/ssl.rb","lineNumber":195,"sourceCode":"    ssl_context = @ssl_provider.load_context(certname: certname, password: password)\n    puts ssl_context.client_cert.to_text\n  end\n\n  def submit_request(ssl_context)\n    key = @cert_provider.load_private_key(Puppet[:certname])\n    unless key\n      key = create_key(Puppet[:certname])\n      @cert_provider.save_private_key(Puppet[:certname], key)\n    end\n\n    csr = @cert_provider.create_request(Puppet[:certname], key)\n    route = create_route(ssl_context)\n    route.put_certificate_request(Puppet[:certname], csr, ssl_context: ssl_context)\n    @cert_provider.save_request(Puppet[:certname], csr)\n    Puppet.notice _(\"Submitted certificate request for '%{name}' to %{url}\") % { name: Puppet[:certname], url: route.url }\n  rescue Puppet::HTTP::ResponseError => e\n    if e.response.code == 400\n      raise Puppet::Error, _(\"Could not submit certificate request for '%{name}' to %{url} due to a conflict on the server\") % { name: Puppet[:certname], url: route.url }\n    else\n      raise Puppet::Error.new(_(\"Failed to submit certificate request: %{message}\") % { message: e.message }, e)\n    end\n  rescue => e\n    raise Puppet::Error.new(_(\"Failed to submit certificate request: %{message}\") % { message: e.message }, e)\n  end\n\n  def generate_request(certname)\n    key = @cert_provider.load_private_key(certname)\n    unless key\n      key = create_key(certname)\n      @cert_provider.save_private_key(certname, key)\n    end\n\n    csr = @cert_provider.create_request(certname, key)\n    @cert_provider.save_request(certname, csr)\n    Puppet.notice _(\"Generated certificate request in '%{path}'\") % { path: @cert_provider.to_path(Puppet[:requestdir], certname) }\n  rescue => e","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/application/ssl.rb#L177-L213","documentation":"Raised while handling a `Puppet::HTTP::ResponseError` from `route.put_certificate_request` when the CA answers HTTP 400 to a CSR submission. In this code path a 400 means the server rejected the request as conflicting — a CSR for that certname already exists whose content (subject, DNS alt names, CSR attributes, or policy fields) differs from the newly submitted one. The local key and CSR generation succeeded; it is server-side state that blocks the request.","triggerScenarios":"The agent runs `puppet ssl submit_certificate_request` or `puppet ssl bootstrap` after regenerating its private key or editing csr_attributes.yaml/policy.json while the CA still holds the previous CSR; the branch `if e.response.code == 400` fires and re-raises as this Puppet::Error.","commonSituations":"Wiping /etc/puppetlabs/puppet/ssl on the agent without cleaning on the CA; changing dns_alt_names or CSR attributes between attempts; a CA signing policy that mutates CSRs; load-balanced compile masters where only some servers have the old request.","solutions":["Clean the existing request on the CA: `puppetserver ca clean --certname <certname>`, then re-run `puppet ssl bootstrap`","On the agent, run `puppet ssl clean` before resubmitting so the local key/CSR state is consistent with what is sent","Diff csr_attributes.yaml / dns_alt_names against what was first submitted and align them","If it persists, check the CA's puppetserver log for the 400 response body, which states the exact conflict reason"],"exampleFix":"# on the CA\npuppetserver ca clean --certname node1.example.com\n# on the agent\npuppet ssl clean\npuppet ssl bootstrap","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"begin\n  route.put_certificate_request(certname, csr, ssl_context: ssl_context)\nrescue Puppet::HTTP::ResponseError => e\n  raise if e.response.code != 400\n  # 400 = server-side conflict with the existing CSR\n  Puppet.err \"CSR conflict (HTTP 400) for #{certname}: clean the cert on the CA, then resubmit\"\n  raise Puppet::Error, e.message, e\nend","preventionTips":["Always pair an agent-side `puppet ssl clean` with `puppetserver ca clean --certname` when regenerating keys","Keep csr_attributes.yaml and dns_alt_names stable between submission attempts","Automate one bootstrap path so CSRs are submitted exactly once per cert lifecycle"],"tags":["puppet-ssl","csr","http-400","ca-conflict","certificate"],"backgroundTag":"http-400-bad-request","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-22T04:17:13.399Z"}