{"record":{"id":"fd88bc1ee46223f7","repo":"puppetlabs/puppet","slug":"extra-arguments-detected-args-did-you-mean-to","errorCode":null,"errorMessage":"Extra arguments detected: %{args}\nDid you mean to run:\n  puppetserver ca clean --certname <name>\nOr:\n  puppet ssl clean --target <name>","messagePattern":"Extra arguments detected: %(.+?)\nDid you mean to run:\n  puppetserver ca clean --certname <name>\nOr:\n  puppet ssl clean --target <name>","errorType":"validation","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/application/ssl.rb","lineNumber":152,"sourceCode":"        cert = download_cert(ssl_context)\n        unless cert\n          Puppet.info(_(\"The certificate for '%{name}' has not yet been signed\") % { name: certname })\n        end\n      end\n    when 'download_cert'\n      ssl_context = @machine.ensure_ca_certificates\n      cert = download_cert(ssl_context)\n      unless cert\n        raise Puppet::Error, _(\"The certificate for '%{name}' has not yet been signed\") % { name: certname }\n      end\n    when 'generate_request'\n      generate_request(certname)\n    when 'verify'\n      verify(certname)\n    when 'clean'\n      possible_extra_args = command_line.args.drop(1)\n      unless possible_extra_args.empty?\n        raise Puppet::Error, _(<<~END) % { args: possible_extra_args.join(' ') }\n          Extra arguments detected: %{args}\n          Did you mean to run:\n            puppetserver ca clean --certname <name>\n          Or:\n            puppet ssl clean --target <name>\n        END\n      end\n\n      clean(certname)\n    when 'bootstrap'\n      unless Puppet::Util::Log.sendlevel?(:info)\n        Puppet::Util::Log.level = :info\n      end\n      @machine.ensure_client_certificate\n      Puppet.notice(_(\"Completed SSL initialization\"))\n    when 'show'\n      show(certname)\n    else","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/application/ssl.rb#L134-L170","documentation":"Thrown by the `clean` action of the `puppet ssl` application when extra positional arguments remain after the action name (the code checks `command_line.args.drop(1)` and requires it to be empty). `puppet ssl clean` takes no certname argument; it only cleans the SSL files of the host running the command, so any extra token is treated as a probable mistake. The message deliberately points at the two commands that do accept a name: `puppetserver ca clean --certname` (on the CA) and `puppet ssl clean --target` (for the target agent).","triggerScenarios":"Running `puppet ssl clean node1.example.com`, or `puppet ssl clean --certname node1` where the unknown flag is not consumed by the option parser and lands in command_line.args; any automation or wrapper that appends a hostname after the `clean` action.","commonSituations":"Muscle memory from `puppet cert clean <name>` or `puppetserver ca clean --certname <name>`; scripts written for the old certificate face; runbooks copied from Puppet 5-era documentation; CI jobs parameterized with a node name that always gets appended.","solutions":["Drop the extra argument: run plain `puppet ssl clean` — it removes this host's cert, private key, public key, and CSR","To remove a certificate for another node, run `puppetserver ca clean --certname <name>` on the CA host","To clean a different target agent, use `puppet ssl clean --target <name>` as the error suggests","Audit wrapper scripts that pass a certname positionally and strip it before invoking puppet"],"exampleFix":"# before\npuppet ssl clean node1.example.com\n# => Extra arguments detected: node1.example.com\n# after\npuppet ssl clean                        # cleans this host\n# on the CA instead:\npuppetserver ca clean --certname node1.example.com","handlingStrategy":"validation","validationCode":"# mirror the app's own check before shelling out\naction = ARGV[0]\nextra  = ARGV.drop(1)\nif action == 'clean' && !extra.empty?\n  abort \"puppet ssl clean takes no extra arguments (got: #{extra.join(' ')})\"\nend\nsystem('puppet', 'ssl', *ARGV)","typeGuard":"def ssl_clean_args_valid?(argv)\n  return true unless argv[0] == 'clean'\n  argv.drop(1).empty?\nend","tryCatchPattern":null,"preventionTips":["Treat `puppet ssl clean` as host-local: never append a certname","In scripts, validate ARGV before invoking the puppet CLI","Prefer `puppetserver ca clean --certname` when a specific cert must be removed"],"tags":["puppet-ssl","cli","argument-validation","certificate-cleanup"],"backgroundTag":"invalid-cli-arguments","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}