is there anyway to "offline " create the a puppet csr? tl;dr, i want to use vault as puppet's ca, but want to use puppet's csr creation method to get all the fancy x509v3 extension magic