puppetlabs/puppet · error · ArgumentError

Cannot specify CSR attribute %{oid}: conflicts with internal

Error message

Cannot specify CSR attribute %{oid}: conflicts with internally used CSR attribute

What it means

Error "Cannot specify CSR attribute %{oid}: conflicts with internally used CSR attribute" thrown in puppetlabs/puppet.

Source

Thrown at lib/puppet/ssl/certificate_request.rb:218

    end
  end

  private

  # Exclude OIDs that may conflict with how Puppet creates CSRs.
  #
  # We only have nominal support for Microsoft extension requests, but since we
  # ultimately respect that field when looking for extension requests in a CSR
  # we need to prevent that field from being written to directly.
  PRIVATE_CSR_ATTRIBUTES = [
    'extReq',   '1.2.840.113549.1.9.14',
    'msExtReq', '1.3.6.1.4.1.311.2.1.14'
  ]

  def add_csr_attributes(csr, csr_attributes)
    csr_attributes.each do |oid, value|
      if PRIVATE_CSR_ATTRIBUTES.include? oid
        raise ArgumentError, _("Cannot specify CSR attribute %{oid}: conflicts with internally used CSR attribute") % { oid: oid }
      end

      encoded = OpenSSL::ASN1::PrintableString.new(value.to_s)

      attr_set = OpenSSL::ASN1::Set.new([encoded])
      csr.add_attribute(OpenSSL::X509::Attribute.new(oid, attr_set))
      Puppet.debug("Added csr attribute: #{oid} => #{attr_set.inspect}")
    rescue OpenSSL::X509::AttributeError => e
      raise Puppet::Error, _("Cannot create CSR with attribute %{oid}: %{message}") % { oid: oid, message: e.message }, e.backtrace
    end
  end

  PRIVATE_EXTENSIONS = [
    'subjectAltName', '2.5.29.17'
  ]

  # @api private
  def extension_request_attribute(options)

View on GitHub (pinned to e227c27540)

When it happens

Trigger: Thrown at lib/puppet/ssl/certificate_request.rb:218 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/8ec9362bcf4b54ff. Report an issue: GitHub.