puppetlabs/puppet · error · Puppet::Error

The CRL is missing from '%{path}'

Error message

The CRL is missing from '%{path}'

What it means

Raised by CertProvider#load_crls when required is true and no PEM data can be read from @crlpath (Puppet[:hostcrl], default ssldir/crl/crl.pem). Puppet loads the CRL whenever certificate_revocation is enabled (the default), so a missing CRL blocks SSL context creation even though the CA cert and client cert are fine.

Source

Thrown at lib/puppet/x509/cert_provider.rb:107

  # @api private
  def save_crls(crls)
    save_pem(crls.map(&:to_pem).join, @crlpath, **permissions_for_setting(:hostcrl))
  rescue SystemCallError => e
    raise Puppet::Error.new(_("Failed to save CRLs to '%{crlpath}'") % { crlpath: @crlpath }, e)
  end

  # Load CRLs from the configured `crlpath` path.
  #
  # @param required [Boolean] If true, raise if they are missing
  # @return (see #load_crls_from_pem)
  # @raise (see #load_crls_from_pem)
  # @raise [Puppet::Error] if the CRLs cannot be loaded
  #
  # @api private
  def load_crls(required: false)
    pem = load_pem(@crlpath)
    if !pem && required
      raise Puppet::Error, _("The CRL is missing from '%{path}'") % { path: @crlpath }
    end

    pem ? load_crls_from_pem(pem) : nil
  rescue SystemCallError => e
    raise Puppet::Error.new(_("Failed to load CRLs from '%{crlpath}'") % { crlpath: @crlpath }, e)
  end

  # Load PEM encoded CRL(s).
  #
  # @param pem [String] PEM encoded CRL(s)
  # @return [Array<OpenSSL::X509::CRL>] Array of CRLs
  # @raise [OpenSSL::X509::CRLError] The `pem` text does not contain a valid CRL
  #
  # @api private
  def load_crls_from_pem(pem)
    # TRANSLATORS 'PEM' is an acronym and shouldn't be translated
    raise OpenSSL::X509::CRLError, _("Failed to parse CRLs as PEM") if pem !~ CRL_DELIMITERS

View on GitHub (pinned to e227c27540)

Solutions

1. Run `puppet agent -t` so the agent downloads crl.pem from the CA
2. Check `puppet config print hostcrl` and confirm the file exists and is non-empty
3. Copy the CRL from the CA (ssldir/ca/ca_crl.pem on the Puppet server) into hostcrl
4. If revocation checking is deliberately off, set certificate_revocation=false so the CRL is not required

Example fix

# before
$ ls /etc/puppetlabs/puppet/ssl/crl/
(empty)

# after (on the CA node)
$ cp /etc/puppetlabs/puppet/ssl/ca/ca_crl.pem /etc/puppetlabs/puppet/ssl/crl/crl.pem

crl = Puppet[:hostcrl]
need_crl = Puppet[:certificate_revocation]
raise "CRL missing at #{crl} — run `puppet agent -t`" if need_crl && !File.size?(crl)

begin
  crls = provider.load_crls(required: true)
rescue Puppet::Error => e
  abort "CRL unavailable (#{e.message}); fetch with `puppet agent -t` or disable certificate_revocation"
end

When it happens

Trigger: SSLProvider#load_context with certificate_revocation enabled on a host whose crl.pem was never fetched or was deleted; ssldir cloned/migrated incompletely (ca.pem copied, crl.pem not). Direct call: load_crls(required: true) with the file absent or empty.

Common situations: Golden VM images cloned without the CRL; cleanup jobs pruning 'stale' files under ssldir; nodes provisioned by hand where only the cert chain was copied from the CA.

Related errors

• The CA certificates are missing from '%{path}'
• Failed to parse CA certificates as PEM
• Failed to parse CRLs as PEM
• The private key is missing from '%{path}'
• The client certificate is missing from '%{path}'

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/98ff64de448d77aa. Report an issue: GitHub.