The openssl provider for the x509_cert type when using a CA for signing creates a certificate with the proper options Failure/Error: openssl options #<Puppet::Type::X509_cert::ProviderOpenssl (class)> received :openssl with unexpected arguments expected: (["x509", "-req", "-days", 3650, "-in", "/tmp/foo.csr", "-out", "/tmp/foo.crt", "-extfile", "/tmp/foo....reateserial"], ["-CA", "/tmp/foo-ca.crt"], ["-CAkey", "/tmp/foo-ca.key"], ["-extensions", "v3_req"]]) got: (["x509", "-req", "-days", 3650, "-in", "/tmp/foo.csr", "-out", "/tmp/foo.crt", ["-extfile", "/tmp/foo...reateserial"], ["-CA", "/tmp/foo-ca.crt"], ["-CAkey", "/tmp/foo-ca.key"], ["-extensions", "v3_req"]])