puppetlabs/puppet · error · Puppet::Error

Cannot create CSR with extension request %{oid}: %{message}

Error message

Cannot create CSR with extension request %{oid}: %{message}

What it means

Error "Cannot create CSR with extension request %{oid}: %{message}" thrown in puppetlabs/puppet.

Source

Thrown at lib/puppet/ssl/certificate_request.rb:248

  PRIVATE_EXTENSIONS = [
    'subjectAltName', '2.5.29.17'
  ]

  # @api private
  def extension_request_attribute(options)
    extensions = []

    if options[:extension_requests]
      options[:extension_requests].each_pair do |oid, value|
        if PRIVATE_EXTENSIONS.include? oid
          raise Puppet::Error, _("Cannot specify CSR extension request %{oid}: conflicts with internally used extension request") % { oid: oid }
        end

        ext = OpenSSL::X509::Extension.new(oid, OpenSSL::ASN1::UTF8String.new(value.to_s).to_der, false)
        extensions << ext
      rescue OpenSSL::X509::ExtensionError => e
        raise Puppet::Error, _("Cannot create CSR with extension request %{oid}: %{message}") % { oid: oid, message: e.message }, e.backtrace
      end
    end

    if options[:dns_alt_names]
      raw_names = options[:dns_alt_names].split(/\s*,\s*/).map(&:strip) + [name]

      parsed_names = raw_names.map do |name|
        if !name.start_with?("IP:") && !name.start_with?("DNS:")
          "DNS:#{name}"
        else
          name
        end
      end.sort.uniq.join(", ")

      alt_names_ext = extension_factory.create_extension("subjectAltName", parsed_names, false)

      extensions << alt_names_ext
    end

View on GitHub (pinned to e227c27540)

When it happens

Trigger: Thrown at lib/puppet/ssl/certificate_request.rb:248 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/3043e2a121615db7. Report an issue: GitHub.