puppetlabs/puppet · error · Puppet::FileSystem::PathPattern::InvalidPattern

PathPatterns cannot be created with a zero byte.

Error message

PathPatterns cannot be created with a zero byte.

What it means

Puppet builds a system TLS trust context from the ssl_trust_store setting. When that setting points to a non-empty regular file, create_system_context calls store.add_file(path); if Ruby/OpenSSL cannot load the file as a certificate source, Puppet logs this error and continues without it. The process still runs with the system CA store plus its own cacerts, but any TLS peer whose chain resolves only through the rejected file will then fail certificate verification. The %{detail} field carries the underlying OpenSSL message, which is almost always a PEM parse failure.

Source

Thrown at lib/puppet/file_system/path_pattern.rb:62

    attr_reader :pathname

    private

    def validate
      if @pathstr.split(Pathname::SEPARATOR_PAT).any? { |f| f == DOTDOT }
        raise(InvalidPattern, _("PathPatterns cannot be created with directory traversals."))
      elsif @pathstr.match?(CURRENT_DRIVE_RELATIVE_WINDOWS)
        raise(InvalidPattern, _("A PathPattern cannot be a Windows current drive relative path."))
      end
    end

    def initialize(pattern)
      begin
        @pathname = Pathname.new(pattern.strip)
        @pathstr = @pathname.to_s
      rescue ArgumentError => error
        raise InvalidPattern.new(_("PathPatterns cannot be created with a zero byte."), error)
      end
      validate
    end
  end

  class RelativePathPattern < PathPattern
    def absolute?
      false
    end

    def validate
      super
      if @pathstr.match?(ABSOLUTE_WINDOWS)
        raise(InvalidPattern, _("A relative PathPattern cannot be prefixed with a drive."))
      elsif @pathstr.match?(ABSOLUTE_UNIX)
        raise(InvalidPattern, _("A relative PathPattern cannot be an absolute path."))
      end
    end

View on GitHub (pinned to e227c27540)

Solutions

1. Read the %{detail} portion of the log line to get the exact OpenSSL reason; it usually names the PEM decode failure.
2. Verify the file parses as a certificate bundle: openssl crl2pkcs7 -nocrl -certfile /path/to/trust_store | openssl pkcs7 -print_certs -noout (a clean parse prints every certificate's subject).
3. If the file is DER, convert it: openssl x509 -inform DER -in ca.der -out ca.pem and point ssl_trust_store at ca.pem.
4. Ensure the file is readable by the puppet user (mode 0644) and contains only -----BEGIN CERTIFICATE----- blocks.
5. Re-run puppet ssl bootstrap (or puppet agent --test) and confirm TLS verification against the CA/server succeeds.

Example fix

# before: DER-encoded CA assigned to ssl_trust_store
[main]
ssl_trust_store = /etc/puppetlabs/puppet/company-ca.der   # -> Failed to add ... as a trusted CA file

# after: convert to PEM and use that path
# openssl x509 -inform DER -in company-ca.der -out company-ca.pem
[main]
ssl_trust_store = /etc/puppetlabs/puppet/company-ca.pem

# Validate the trust store exactly the way the provider will load it
def trust_store_loads?(path)
  return false unless File.file?(path) && File.size(path).positive?
  OpenSSL::X509::Store.new.add_file(path)
  true
rescue OpenSSL::X509::StoreError, OpenSSL::X509::CertificateError
  false
end

exit 1 unless trust_store_loads?(Puppet[:ssl_trust_store])

When it happens

Trigger: Setting ssl_trust_store to a DER (binary) encoded CA instead of PEM; a PEM file with corrupted base64, stray text around the BEGIN/END CERTIFICATE delimiters, or damaged line endings; a file that holds a private key or CRL instead of CA certificates; any content OpenSSL refuses through X509::Store#add_file. Note that empty files are silently skipped and directories take a separate warning branch, so neither produces this error.

Common situations: Pointing ssl_trust_store at an internal company CA exported from a browser or Windows certmgr in DER form; concatenating PEM bundles with a script that mangles headers; migrating puppet.conf to a host where the trust store path now contains different content; PEM files that stat as readable but decode partially.

Related errors

• Failed to parse CA certificates as PEM
• Failed to parse CRLs as PEM
• The CA certificates are missing from '%{path}'
• Request to Puppet Forge failed. Detail: %{detail}.
• An action must be specified.

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/1dfefb4aab7a257b. Report an issue: GitHub.