{"record":{"id":"d012320f5314f906","repo":"puppetlabs/puppet","slug":"couldn-t-fetch-certificate-from-ca-server-you-mig","errorCode":null,"errorMessage":"Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (%{name}). Exiting now because the maxwaitforcert timeout has been exceeded.","messagePattern":"Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate \\(%(.+?)\\)\\. Exiting now because the maxwaitforcert timeout has been exceeded\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/puppet/ssl/state_machine.rb","lineNumber":412,"sourceCode":"      Puppet.warning(_(\"Unable to automatically renew certificate: %{message}\") % { message: e.message })\n      Done.new(@machine, @ssl_context)\n    end\n  end\n\n  # We cannot make progress, so wait if allowed to do so, or exit.\n  #\n  class Wait < SSLState\n    def initialize(machine)\n      super(machine, nil)\n    end\n\n    def next_state\n      time = @machine.waitforcert\n      if time < 1\n        log_error(_(\"Exiting now because the waitforcert setting is set to 0.\"))\n        exit(1)\n      elsif Time.now.to_i > @machine.wait_deadline\n        log_error(_(\"Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (%{name}). Exiting now because the maxwaitforcert timeout has been exceeded.\") % { name: Puppet[:certname] })\n        exit(1)\n      else\n        Puppet.info(_(\"Will try again in %{time} seconds.\") % { time: time })\n\n        # close http/tls and session state before sleeping\n        Puppet.runtime[:http].close\n        @machine.session = Puppet.runtime[:http].create_session\n\n        @machine.unlock\n        Kernel.sleep(time)\n        NeedLock.new(@machine)\n      end\n    end\n  end\n\n  # Acquire the ssl lock or return LockFailure causing us to exit.\n  #\n  class NeedLock < SSLState","sourceCodeStart":394,"sourceCodeEnd":430,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/ssl/state_machine.rb#L394-L430","documentation":"Error \"Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (%{name}). Exiting now because the maxwaitforcert timeout has been exceeded.\" thrown in puppetlabs/puppet.","triggerScenarios":"Thrown at lib/puppet/ssl/state_machine.rb:412 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}