puppetlabs/puppet · error · Puppet::SSL::SSLError

The CSR for host '%{name}' does not match the public key

Error message

The CSR for host '%{name}' does not match the public key

What it means

Error "The CSR for host '%{name}' does not match the public key" thrown in puppetlabs/puppet.

Source

Thrown at lib/puppet/ssl/ssl_provider.rb:208

    client_cert = cert.load_client_cert(certname, required: true)

    create_context(cacerts: cacerts, crls: crls,  private_key: private_key, client_cert: client_cert, revocation: revocation, include_system_store: include_system_store)
  rescue OpenSSL::PKey::PKeyError => e
    raise Puppet::SSL::SSLError.new(_("Failed to load private key for host '%{name}': %{message}") % { name: certname, message: e.message }, e)
  end

  # Verify the `csr` was signed with a private key corresponding to the
  # `public_key`. This ensures the CSR was signed by someone in possession
  # of the private key, and that it hasn't been tampered with since.
  #
  # @param csr [OpenSSL::X509::Request] certificate signing request
  # @param public_key [OpenSSL::PKey::RSA, OpenSSL::PKey::EC] public key
  # @raise [Puppet::SSL:SSLError] The private_key for the given `public_key` was
  #   not used to sign the CSR.
  # @api private
  def verify_request(csr, public_key)
    unless csr.verify(public_key)
      raise Puppet::SSL::SSLError, _("The CSR for host '%{name}' does not match the public key") % { name: subject(csr) }
    end

    csr
  end

  def print(ssl_context, alg = 'SHA256')
    if Puppet::Util::Log.sendlevel?(:debug)
      chain = ssl_context.client_chain
      # print from root to client
      chain.reverse.each_with_index do |cert, i|
        digest = Puppet::SSL::Digest.new(alg, cert.to_der)
        if i == chain.length - 1
          Puppet.debug(_("Verified client certificate '%{subject}' fingerprint %{digest}") % { subject: cert.subject.to_utf8, digest: digest })
        else
          Puppet.debug(_("Verified CA certificate '%{subject}' fingerprint %{digest}") % { subject: cert.subject.to_utf8, digest: digest })
        end
      end
      ssl_context.crls.each do |crl|

View on GitHub (pinned to e227c27540)

When it happens

Trigger: Thrown at lib/puppet/ssl/ssl_provider.rb:208 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/52f07522f0dce945. Report an issue: GitHub.