puppetlabs/puppet · error · Puppet::Error

Cannot create CSR with attribute %{oid}: %{message}

Error message

Cannot create CSR with attribute %{oid}: %{message}

What it means

Error "Cannot create CSR with attribute %{oid}: %{message}" thrown in puppetlabs/puppet.

Source

Thrown at lib/puppet/ssl/certificate_request.rb:227

  # we need to prevent that field from being written to directly.
  PRIVATE_CSR_ATTRIBUTES = [
    'extReq',   '1.2.840.113549.1.9.14',
    'msExtReq', '1.3.6.1.4.1.311.2.1.14'
  ]

  def add_csr_attributes(csr, csr_attributes)
    csr_attributes.each do |oid, value|
      if PRIVATE_CSR_ATTRIBUTES.include? oid
        raise ArgumentError, _("Cannot specify CSR attribute %{oid}: conflicts with internally used CSR attribute") % { oid: oid }
      end

      encoded = OpenSSL::ASN1::PrintableString.new(value.to_s)

      attr_set = OpenSSL::ASN1::Set.new([encoded])
      csr.add_attribute(OpenSSL::X509::Attribute.new(oid, attr_set))
      Puppet.debug("Added csr attribute: #{oid} => #{attr_set.inspect}")
    rescue OpenSSL::X509::AttributeError => e
      raise Puppet::Error, _("Cannot create CSR with attribute %{oid}: %{message}") % { oid: oid, message: e.message }, e.backtrace
    end
  end

  PRIVATE_EXTENSIONS = [
    'subjectAltName', '2.5.29.17'
  ]

  # @api private
  def extension_request_attribute(options)
    extensions = []

    if options[:extension_requests]
      options[:extension_requests].each_pair do |oid, value|
        if PRIVATE_EXTENSIONS.include? oid
          raise Puppet::Error, _("Cannot specify CSR extension request %{oid}: conflicts with internally used extension request") % { oid: oid }
        end

        ext = OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(value.to_s).to_der, false)

View on GitHub (pinned to e227c27540)

When it happens

Trigger: Thrown at lib/puppet/ssl/certificate_request.rb:227 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/f91dfb6ab9934a0c. Report an issue: GitHub.