this isn't necessarily the most elegant solution, but:

#!/bin/bash
FQDN=$(hostname).$(dnsdomainname)
CERTPATH=/etc/puppetlabs/puppet/ssl/certs/$FQDN.pem
if openssl x509 -in $CERTPATH -text | grep -q "pe_compiler"; then
  echo "is compiler"
else
  echo "is not compiler"
fi