{"record":{"id":"f3c84866dcee751d","repo":"puppetlabs/puppet","slug":"expected-an-instance-of-puppet-ssl-verifier-but","errorCode":null,"errorMessage":"Expected an instance of Puppet::SSL::Verifier but was passed a %{klass}","messagePattern":"Expected an instance of Puppet::SSL::Verifier but was passed a %(.+?)","errorType":"exception","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"lib/puppet/network/http/connection.rb","lineNumber":55,"sourceCode":"  #   any verification to do on the connection\n  # @option options [Integer] :redirect_limit the number of allowed\n  #   redirections, defaults to 10 passing any other option in the options\n  #   hash results in a Puppet::Error exception\n  #\n  # @note the HTTP connection itself happens lazily only when {#request}, or\n  #   one of the {#get}, {#post}, {#delete}, {#head} or {#put} is called\n  # @note The correct way to obtain a connection is to use one of the factory\n  #   methods on {Puppet::Network::HttpPool}\n  # @api private\n  def initialize(host, port, options = {})\n    unknown_options = options.keys - OPTION_DEFAULTS.keys\n    raise Puppet::Error, _(\"Unrecognized option(s): %{opts}\") % { opts: unknown_options.map(&:inspect).sort.join(', ') } unless unknown_options.empty?\n\n    options = OPTION_DEFAULTS.merge(options)\n    @use_ssl = options[:use_ssl]\n    if @use_ssl\n      unless options[:verifier].is_a?(Puppet::SSL::Verifier)\n        raise ArgumentError, _(\"Expected an instance of Puppet::SSL::Verifier but was passed a %{klass}\") % { klass: options[:verifier].class }\n      end\n\n      @verifier = options[:verifier]\n    end\n    @redirect_limit = options[:redirect_limit]\n    @site = Puppet::HTTP::Site.new(@use_ssl ? 'https' : 'http', host, port)\n    @client = Puppet.runtime[:http]\n  end\n\n  # The address to connect to.\n  def address\n    @site.host\n  end\n\n  # The port to connect to.\n  def port\n    @site.port\n  end","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/network/http/connection.rb#L37-L73","documentation":"When use_ssl is true, the connection requires its verifier option to be an instance of Puppet::SSL::Verifier; anything else (nil, an OpenSSL object, a Puppet 4 VerifierWrapper, a custom class) raises ArgumentError naming the actual class. The verifier bundles the hostname and SSLContext used to verify the peer during TLS, so a stand-in object cannot be accepted.","triggerScenarios":"Constructing the connection with use_ssl: true (the default) but omitting verifier; passing an OpenSSL::SSL::SSLContext or a Puppet::SSL::VerifierWrapper directly; handing in a hand-rolled duck-typed verifier object.","commonSituations":"Upgrades from Puppet 4 where verification used ':verify => false' or verifier factories; code that builds its own SSLContext and passes it where a verifier is expected; constructor signatures copied without the verifier argument.","solutions":["Create and pass a real verifier: Puppet::SSL::Verifier.new(host, ssl_context)","Obtain the ssl_context from the SSL provider (e.g. Puppet::SSL::SSLProvider) rather than building OpenSSL objects manually","Migrate to Puppet.runtime[:http], which constructs verifiers internally","Ensure verifier is passed whenever use_ssl is true (it defaults to true)"],"exampleFix":"# before: raw SSLContext passed as verifier\nconn = Puppet::Network::HTTP::Connection.new('puppet', 8140,\n                                             use_ssl: true, verifier: my_ssl_context)\n\n# after\nverifier = Puppet::SSL::Verifier.new('puppet', Puppet.lookup(:ssl_context))\nconn = Puppet::Network::HTTP::Connection.new('puppet', 8140,\n                                             use_ssl: true, verifier: verifier)","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"def ssl_verifier?(obj)\n  obj.is_a?(Puppet::SSL::Verifier)\nend\n\nraise ArgumentError, 'verifier must be Puppet::SSL::Verifier' unless ssl_verifier?(verifier)","tryCatchPattern":null,"preventionTips":["Always build verifiers through Puppet::SSL::Verifier.new(host, ssl_context)","Never pass a raw OpenSSL::SSL::SSLContext where a verifier is expected"],"tags":["ssl","verifier","type-check","http-client"],"backgroundTag":"wrong-argument-type","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}