i do

puppet plan run

this triggers an orchestrator plan run, which does a hiera query, which does eyaml, which results in

Error was parsing issue: certificate issuer is an empty distinguished name

. afaik PE did something to hiera-eyaml on encryption level, but i do decryption here? the plan runs in the orchestration service, so in its java/jruby? when i do

puppetserver gem list hiera-eyaml

i get

hiera-eyaml (5.0.1, 4.3.0)

… this seems not so good, having two versions here?

Hey @Robert Waffen, I know there was a known issue with Bouncy Castle (i think in PE 2025.11?) My quick research shows this should have been corrected in PE 2025.11.2 by including hiera-eyaml 5.0.1 (which looks like it is there on your server). Is it possible the 4.3.0 is from a manual install from another time trying to work around the fix for this issue? I did some Claude digging on this, trying to see if there was possibly a place to investigate, and it highlighted that the broken version should be 3.4.0 that was previously shipped in PE. The Claude dig also suggested that since you are seeing this in the orchestration, maybe the orchestrator log might have a trace that can help nail down where there is an old hiera-eyaml being loaded? You might want to log a support ticket, and make sure to include the PE version and the versions of hiera you are seeing, and any other logs that could be helpful.

my customer will open up a support case with our debug summary from yesterday to this topic

Ah… there’s that evil 3.4.0. I wonder why it’s sitting over in the bolt server and didn’t get updated? Hopefully support/engineering can dig in and figure it out! Thanks for helping get that ticket in so this can get resolved.