FWIW, the fix is to change /usr/lib/ruby/vendor_ruby/puppet/ssl/base.rb: - VALID_CERTNAME = /\A[ -.0-~]+\Z/ + VALID_CERTNAME = /\A[ -.0-~\/]+\Z/ (i.e. add / to permitted characters).