This message was deleted.

Usually puppet agent uses the fqdn. but you can specify

certname

in puppet.conf agent section. In this case the agent always uses the certname setting and not the fqdn. Please check if facter fqdn return the hostname or the fqdn.

yep - tried using certname in puppet.conf. It 'works' - but the agent still sends requests for <hostname>.home, despite already having a signed cert as just <hostname>. What would make an agent want a second cert?