puppetserver

defaults to using the end-entity certificate of the

puppet

agent service on port 8140 which is signed by the Puppet CA certificate.

puppetserver

never has used or presented the Puppet CA certificate directly.