puppetlabs/puppet · error · Puppet::SSL::SSLError

Unsupported key '%{type}'

Error message

Unsupported key '%{type}'

What it means

Error "Unsupported key '%{type}'" thrown in puppetlabs/puppet.

Source

Thrown at lib/puppet/ssl/ssl_provider.rb:285

  end

  def revocation_mode(mode)
    case mode
    when false
      0
    when :leaf
      OpenSSL::X509::V_FLAG_CRL_CHECK
    else
      # :chain is the default
      OpenSSL::X509::V_FLAG_CRL_CHECK | OpenSSL::X509::V_FLAG_CRL_CHECK_ALL
    end
  end

  def resolve_client_chain(store, client_cert, private_key)
    client_chain = verify_cert_with_store(store, client_cert)

    if !private_key.is_a?(OpenSSL::PKey::RSA) && !private_key.is_a?(OpenSSL::PKey::EC)
      raise Puppet::SSL::SSLError, _("Unsupported key '%{type}'") % { type: private_key.class.name }
    end

    unless client_cert.check_private_key(private_key)
      raise Puppet::SSL::SSLError, _("The certificate for '%{name}' does not match its private key") % { name: subject(client_cert) }
    end

    client_chain
  end

  def verify_cert_with_store(store, cert)
    # StoreContext#initialize accepts a chain argument, but it's set to [] because
    # puppet requires any intermediate CA certs needed to complete the client's
    # chain to be in the CA bundle that we downloaded from the server, and
    # they've already been added to the store. See PUP-9500.

    store_context = OpenSSL::X509::StoreContext.new(store, cert, [])
    unless store_context.verify
      current_cert = store_context.current_cert

View on GitHub (pinned to e227c27540)

When it happens

Trigger: Thrown at lib/puppet/ssl/ssl_provider.rb:285 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/cf0bf43ba0c557ae. Report an issue: GitHub.