That's one of the reasons we use hiera instead, to deploy files to primary/replica via puppet. Can't use console-cert due to resource conflict, puppet manages this file unconditionally