puppetlabs/puppet · error · Puppet::Error

Unknown action '%{action}'

Error message

Unknown action '%{action}'

What it means

Raised from the `else` branch of the action dispatch in `Puppet::Application::SSL#main`: the first positional argument matched none of the supported actions. The recognized actions are submit_certificate_request, generate_request, verify, clean, bootstrap, and show. It is a pure usage error raised before any SSL work starts, so no files or requests are touched when it fires.

Source

Thrown at lib/puppet/application/ssl.rb:171

          Extra arguments detected: %{args}
          Did you mean to run:
            puppetserver ca clean --certname <name>
          Or:
            puppet ssl clean --target <name>
        END
      end

      clean(certname)
    when 'bootstrap'
      unless Puppet::Util::Log.sendlevel?(:info)
        Puppet::Util::Log.level = :info
      end
      @machine.ensure_client_certificate
      Puppet.notice(_("Completed SSL initialization"))
    when 'show'
      show(certname)
    else
      raise Puppet::Error, _("Unknown action '%{action}'") % { action: action }
    end
  end

  def show(certname)
    password = @cert_provider.load_private_key_password
    ssl_context = @ssl_provider.load_context(certname: certname, password: password)
    puts ssl_context.client_cert.to_text
  end

  def submit_request(ssl_context)
    key = @cert_provider.load_private_key(Puppet[:certname])
    unless key
      key = create_key(Puppet[:certname])
      @cert_provider.save_private_key(Puppet[:certname], key)
    end

    csr = @cert_provider.create_request(Puppet[:certname], key)
    route = create_route(ssl_context)

View on GitHub (pinned to e227c27540)

Solutions

1. Run `puppet ssl --help` and use one of: submit_certificate_request, generate_request, verify, clean, bootstrap, show
2. For full initial certificate setup use `puppet ssl bootstrap`
3. Check for stray quoting or a shifted first positional token in scripts

Example fix

# before
puppet ssl request
# after
puppet ssl submit_certificate_request
# or the usual one-shot:
puppet ssl bootstrap

SSL_ACTIONS = %w[submit_certificate_request generate_request verify clean bootstrap show].freeze
unless SSL_ACTIONS.include?(ARGV[0])
  abort "unknown action '#{ARGV[0]}'; valid: #{SSL_ACTIONS.join(', ')}"
end

def ssl_action?(name)
  %w[submit_certificate_request generate_request verify clean bootstrap show].include?(name)
end

When it happens

Trigger: Invoking `puppet ssl <verb>` with an unsupported verb: `puppet ssl submit` (the real action is submit_certificate_request), `puppet ssl request`, `puppet ssl bootstrap-cert`, or any typo; also automation assuming an action name from an older Puppet version.

Common situations: Runbooks written for Puppet 5 before `puppet ssl` gained these actions; abbreviating action names; shell completion or internal docs out of date after an upgrade.

Related errors

• Extra arguments detected: %{args} Did you mean to run: pup
• Error parsing arguments
• The puppet agent command does not take parameters
• puppet %{face} %{action} takes %{arg_count} argument, but yo
• Need exactly two arguments: filebucket diff <file_a> <file_b

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/5537cd9be2a7527d. Report an issue: GitHub.