if it's already expired, you'll have to regenerate...
# puppet
l
if it's already expired, you'll have to regenerate the cert and reconnect all the devices