{"record":{"id":"ca0d67c6d47b5f06","repo":"puppetlabs/puppet","slug":"invalid-certificate-revocation-value-value-mus","errorCode":null,"errorMessage":"Invalid certificate revocation value %{value}: must be one of 'true', 'chain', 'leaf', or 'false'","messagePattern":"Invalid certificate revocation value %(.+?): must be one of 'true', 'chain', 'leaf', or 'false'","errorType":"validation","errorClass":"Puppet::Settings::ValidationError","httpStatus":null,"severity":"error","filePath":"lib/puppet/settings/certificate_revocation_setting.rb","lineNumber":19,"sourceCode":"# frozen_string_literal: true\n\nrequire_relative '../../puppet/settings/base_setting'\n\nclass Puppet::Settings::CertificateRevocationSetting < Puppet::Settings::BaseSetting\n  def type\n    :certificate_revocation\n  end\n\n  def munge(value)\n    case value\n    when 'chain', 'true', TrueClass\n      :chain\n    when 'leaf'\n      :leaf\n    when 'false', FalseClass, NilClass\n      false\n    else\n      raise Puppet::Settings::ValidationError, _(\"Invalid certificate revocation value %{value}: must be one of 'true', 'chain', 'leaf', or 'false'\") % { value: value }\n    end\n  end\nend\n","sourceCodeStart":1,"sourceCodeEnd":23,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/settings/certificate_revocation_setting.rb#L1-L23","documentation":"Puppet::Settings::CertificateRevocationSetting#munge validates certificate_revocation (CRL checking behavior): 'chain'/'true'/true become :chain (validate the whole chain), 'leaf' becomes :leaf (check only leaf certs), and 'false'/false/nil become false (disable). The match is case-sensitive and exact, so 'TRUE', 1, 'chain, leaf', or symbols raise Puppet::Settings::ValidationError.","triggerScenarios":"puppet.conf `certificate_revocation = TRUE` (uppercase from a template); `= 1`; `= all`; passing a symbol :chain from Ruby code instead of the string.","commonSituations":"Templated configs uppercasing values; operators writing 1/0 truthiness; misunderstanding the allowed vocabulary (it is a four-value enum, not a boolean).","solutions":["Use one of the exact lowercase strings: 'true'/'chain', 'leaf', or 'false'.","Fix templates that uppercase or numericize the value.","If you only want a boolean, use true/false — 'true' means chain-checking."],"exampleFix":"# before (puppet.conf [server])\ncertificate_revocation = TRUE\n\n# after\ncertificate_revocation = chain","handlingStrategy":"validation","validationCode":"VALID = ['chain', 'true', true, 'leaf', 'false', false, nil]\nraise Puppet::Settings::ValidationError, \"certificate_revocation must be true/chain/leaf/false\" unless VALID.include?(v)","typeGuard":"valid_crl_mode = ->(v) { ['chain', 'true', true, 'leaf', 'false', false, nil].include?(v) }","tryCatchPattern":"begin\n  Puppet.settings[:certificate_revocation] = v\nrescue Puppet::Settings::ValidationError => e\n  raise unless e.message.include?('certificate revocation')\n  Puppet.err(\"#{e.message} — lowercase exact values only\")\n  raise\nend","preventionTips":["Treat certificate_revocation as a four-value enum, not a boolean","Lowercase all enum values in templated configs","Never substitute 1/0 or TRUE/FALSE for the accepted strings"],"tags":["puppet","settings","certificate-revocation","crl","enum","validation-error"],"backgroundTag":"invalid-enum-config-value","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}