I have a seperate ansible playbook for my ACME letandcrypt tasks, then later sync it to the puppet servers and the puppetserver is responsible for distribution the certificates to the agent.