puppetlabs/puppet · error · Puppet::Settings::ValidationError

Invalid certificate revocation value %{value}: must be one o

Error message

Invalid certificate revocation value %{value}: must be one of 'true', 'chain', 'leaf', or 'false'

What it means

Puppet::Settings::CertificateRevocationSetting#munge validates certificate_revocation (CRL checking behavior): 'chain'/'true'/true become :chain (validate the whole chain), 'leaf' becomes :leaf (check only leaf certs), and 'false'/false/nil become false (disable). The match is case-sensitive and exact, so 'TRUE', 1, 'chain, leaf', or symbols raise Puppet::Settings::ValidationError.

Source

Thrown at lib/puppet/settings/certificate_revocation_setting.rb:19

# frozen_string_literal: true

require_relative '../../puppet/settings/base_setting'

class Puppet::Settings::CertificateRevocationSetting < Puppet::Settings::BaseSetting
  def type
    :certificate_revocation
  end

  def munge(value)
    case value
    when 'chain', 'true', TrueClass
      :chain
    when 'leaf'
      :leaf
    when 'false', FalseClass, NilClass
      false
    else
      raise Puppet::Settings::ValidationError, _("Invalid certificate revocation value %{value}: must be one of 'true', 'chain', 'leaf', or 'false'") % { value: value }
    end
  end
end

View on GitHub (pinned to e227c27540)

Solutions

1. Use one of the exact lowercase strings: 'true'/'chain', 'leaf', or 'false'.
2. Fix templates that uppercase or numericize the value.
3. If you only want a boolean, use true/false — 'true' means chain-checking.

Example fix

# before (puppet.conf [server])
certificate_revocation = TRUE

# after
certificate_revocation = chain

VALID = ['chain', 'true', true, 'leaf', 'false', false, nil]
raise Puppet::Settings::ValidationError, "certificate_revocation must be true/chain/leaf/false" unless VALID.include?(v)

valid_crl_mode = ->(v) { ['chain', 'true', true, 'leaf', 'false', false, nil].include?(v) }

begin
  Puppet.settings[:certificate_revocation] = v
rescue Puppet::Settings::ValidationError => e
  raise unless e.message.include?('certificate revocation')
  Puppet.err("#{e.message} — lowercase exact values only")
  raise
end

When it happens

Trigger: puppet.conf `certificate_revocation = TRUE` (uppercase from a template); `= 1`; `= all`; passing a symbol :chain from Ruby code instead of the string.

Common situations: Templated configs uppercasing values; operators writing 1/0 truthiness; misunderstanding the allowed vocabulary (it is a four-value enum, not a boolean).

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Invalid run mode '#{mode}'
• Invalid autosign value %{value}: must be 'true'/'false' or a
• Invalid value '%{value}' for boolean parameter: %{name}
• Invalid duration format '%{value}' for parameter: %{name}
• Invalid environment mode '%{mode_name}'

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/ca0d67c6d47b5f06. Report an issue: GitHub.