yep. here is the story PE 2025.11.2 ships /opt/puppetlabs/share/java/bcprov-jdk18on-1.85.jar; 2025.11.0 shipped 1.84. BouncyCastle 1.85 rejects X.509 certificates whose issuer DN is empty. Certificates produced by "eyaml createkeys" have an empty subject AND an empty issuer DN, so they can no longer be parsed inside puppetserver.