puppetlabs/puppet · error · Puppet::Error

The client certificate is missing from '%{path}'

Error message

The client certificate is missing from '%{path}'

What it means

CertProvider#load_client_cert raises Puppet::Error when required is true and the host certificate file is absent: @hostcert, default certdir/<certname>.pem. The node has a key and CA but no signed certificate, which typically means the CSR has not been signed or the cert has not been fetched yet.

Source

Thrown at lib/puppet/x509/cert_provider.rb:280

    save_pem(cert.to_pem, path, **permissions_for_setting(:hostcert))
  rescue SystemCallError => e
    raise Puppet::Error.new(_("Failed to save client certificate for '%{name}'") % { name: name }, e)
  end

  # Load a named client cert from the configured `certdir`.
  #
  # @param name [String] The client cert identity
  # @param required [Boolean] If true, raise it is missing
  # @return (see #load_request_from_pem)
  # @raise (see #load_client_cert_from_pem)
  # @raise [Puppet::Error] if the client cert cannot be loaded
  #
  # @api private
  def load_client_cert(name, required: false)
    path = @hostcert || to_path(@certdir, name)
    pem = load_pem(path)
    if !pem && required
      raise Puppet::Error, _("The client certificate is missing from '%{path}'") % { path: path }
    end

    pem ? load_client_cert_from_pem(pem) : nil
  rescue SystemCallError => e
    raise Puppet::Error.new(_("Failed to load client certificate for '%{name}'") % { name: name }, e)
  end

  # Load a PEM encoded certificate.
  #
  # @param pem [String] PEM encoded cert
  # @return [OpenSSL::X509::Certificate] the certificate
  # @raise [OpenSSL::X509::CertificateError] The `pem` text does not contain a valid cert
  #
  # @api private
  def load_client_cert_from_pem(pem)
    OpenSSL::X509::Certificate.new(pem)
  end

View on GitHub (pinned to e227c27540)

Solutions

1. Check `puppet config print certname hostcert` and verify the file exists
2. On the CA: `puppetserver ca list` to see the pending request, then `puppetserver ca sign --certname <name>`
3. On the node run `puppet agent -t` to submit the CSR or fetch the signed certificate
4. If certname is wrong, restore the original certname setting
5. If no CSR exists anywhere, remove leftover cert files and re-enroll from scratch

cert = Puppet[:hostcert] || File.join(Puppet[:certdir], "#{Puppet[:certname]}.pem")
raise "client cert missing at #{cert} — is the CSR signed?" unless File.size?(cert)

begin
  cert = provider.load_client_cert(name, required: true)
rescue Puppet::Error => e
  wait_for_ca_sign(name)   # poll `puppetserver ca list`, then `puppet agent -t` to fetch
  cert = provider.load_client_cert(name, required: true)
end

When it happens

Trigger: SSLProvider#load_context on a node whose certificate was never signed/downloaded; certname mismatch so certdir/<name>.pem does not exist for the current identity; hostcert setting pointing at a custom path that no longer exists.

Common situations: New node waiting on manual CA signing or autosign rules that rejected it; cert files cleaned on the node; certname changed after enrollment; cert expired and removed without re-enrollment.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• The CA certificates are missing from '%{path}'
• Failed to parse CA certificates as PEM
• The CRL is missing from '%{path}'
• The private key is missing from '%{path}'
• Failed to parse CRLs as PEM

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/46d3da7e8ec2c9db. Report an issue: GitHub.