puppetlabs/puppet · error · Puppet::Error

The certificate for '%{name}' has not yet been signed

Error message

The certificate for '%{name}' has not yet been signed

What it means

During 'puppet ssl download_cert', if the CA returns no certificate for the node's certname, Puppet::Error is raised: the CSR exists but has not been signed yet. The submit_request path prints the same text only as an info message (Puppet.info), because waiting is normal right after submitting.

Source

Thrown at lib/puppet/application/ssl.rb:143

    Puppet::SSL::Oids.register_puppet_oids
    Puppet::SSL::Oids.load_custom_oid_file(Puppet[:trusted_oid_mapping_file])

    certname = Puppet[:certname]
    action = command_line.args.first
    case action
    when 'submit_request'
      ssl_context = @machine.ensure_ca_certificates
      if submit_request(ssl_context)
        cert = download_cert(ssl_context)
        unless cert
          Puppet.info(_("The certificate for '%{name}' has not yet been signed") % { name: certname })
        end
      end
    when 'download_cert'
      ssl_context = @machine.ensure_ca_certificates
      cert = download_cert(ssl_context)
      unless cert
        raise Puppet::Error, _("The certificate for '%{name}' has not yet been signed") % { name: certname }
      end
    when 'generate_request'
      generate_request(certname)
    when 'verify'
      verify(certname)
    when 'clean'
      possible_extra_args = command_line.args.drop(1)
      unless possible_extra_args.empty?
        raise Puppet::Error, _(<<~END) % { args: possible_extra_args.join(' ') }
          Extra arguments detected: %{args}
          Did you mean to run:
            puppetserver ca clean --certname <name>
          Or:
            puppet ssl clean --target <name>
        END
      end

      clean(certname)

View on GitHub (pinned to e227c27540)

Solutions

1. Sign on the CA: puppetserver ca list, then puppetserver ca sign --certname <name>, and re-run puppet ssl download_cert (or bootstrap)
2. Confirm the agent's certname matches the pending CSR: puppet config print certname
3. If autosigning is intended, add the certname/pattern to the CA's autosign.conf and resubmit
4. Verify the result afterwards with puppet ssl verify

Example fix

# on the CA node
puppetserver ca list
puppetserver ca sign --certname agent.example.com

# on the agent
puppet ssl bootstrap

# before forcing a download, check the CA side
signed = system('puppetserver ca list --signed --certname agent.example.com') # run where CA access exists
download_cert if signed

tries = 0
begin
  tries += 1
  run('puppet ssl download_cert')
rescue Puppet::Error => e
  raise if tries >= 30 || e.message !~ /not yet been signed/
  sleep(60) # wait for CA operator to sign, then retry
  retry
end

When it happens

Trigger: Fresh node: ran submit_request (or the first phase of bootstrap) with autosigning disabled, then ran download_cert before a CA operator signed the CSR; the agent's certname differs from the pending CSR so the CA has nothing to return.

Common situations: New agents onboarding without autosign.conf entries; CI containers generating new certnames each run; the certificate cleaned/revoked on the CA between request and download.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Request to Puppet Forge failed. Detail: %{detail}.
• PathPatterns cannot be created with a zero byte.
• An action must be specified.
• The ssl_context and include_system_store parameters are mutu
• Invalid autosign value %{value}: must be 'true'/'false' or a

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/551de2316ddb5e4b. Report an issue: GitHub.