Agreed. We use

puppet::ca_server

in

theforeman/puppet

and it's simple to manage this at the application level.