Couldn't fetch certificate from CA server; you might still n

Error message

Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (%{name}). Exiting now because the maxwaitforcert timeout has been exceeded.

What it means

Error "Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (%{name}). Exiting now because the maxwaitforcert timeout has been exceeded." thrown in puppetlabs/puppet.

Source

Thrown at lib/puppet/ssl/state_machine.rb:412

      Puppet.warning(_("Unable to automatically renew certificate: %{message}") % { message: e.message })
      Done.new(@machine, @ssl_context)
    end
  end

  # We cannot make progress, so wait if allowed to do so, or exit.
  #
  class Wait < SSLState
    def initialize(machine)
      super(machine, nil)
    end

    def next_state
      time = @machine.waitforcert
      if time < 1
        log_error(_("Exiting now because the waitforcert setting is set to 0."))
        exit(1)
      elsif Time.now.to_i > @machine.wait_deadline
        log_error(_("Couldn't fetch certificate from CA server; you might still need to sign this agent's certificate (%{name}). Exiting now because the maxwaitforcert timeout has been exceeded.") % { name: Puppet[:certname] })
        exit(1)
      else
        Puppet.info(_("Will try again in %{time} seconds.") % { time: time })

        # close http/tls and session state before sleeping
        Puppet.runtime[:http].close
        @machine.session = Puppet.runtime[:http].create_session

        @machine.unlock
        Kernel.sleep(time)
        NeedLock.new(@machine)
      end
    end
  end

  # Acquire the ssl lock or return LockFailure causing us to exit.
  #
  class NeedLock < SSLState

View on GitHub (pinned to e227c27540)

When it happens

Trigger: Thrown at lib/puppet/ssl/state_machine.rb:412 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
Timeouts: ETIMEDOUT, deadlines, and hung requests — what actually expires when a request times out.

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/d012320f5314f906. Report an issue: GitHub.