This probably means file sync got tripped up on something. If your CA is in the old location

/etc/puppetlabs/puppet/ssl/ca

, then this means promoting your replica is going to result in a CA that’s only up to date since the last time it was able to sync. If your CA is in the new location (

/etc/puppetlabs/puppetserver/ca

I think it is), then it doesn’t matter so much as that’s handled separately with a different file sync, if I recall correctly. If it is file sync getting tripped up, usually deleting the file sync cache can fix that. https://puppet.com/docs/pe/2021.7/filesync_about.html#filesync_resetting If your CA is churning through a bunch of certs on a regular basis, this is more likely to happen. We’re currently looking at ways to make this better. Using file sync to sync the CA data isn’t really great, since we don’t care at all about the history, and files changing in the middle of JGit doing its thing tends to break it.