In the server logs, I can see that the certificate looks correct:

Certificate puppet.ppt.svc.cluster.local.pem:
subject=CN = puppet.ppt.svc.cluster.local
issuer=CN = "Puppet CA generated on puppet at 2025-06-15 18:32:45 +0000"
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            Netscape Comment: 
                Puppet Server Internal Certificate
            X509v3 Authority Key Identifier: 
                F1:2E:B5:DB:B6:4E:CF:83:17:A4:72:B2:F8:6F:76:EB:55:78:8B:7A
            X509v3 Extended Key Usage: critical
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Subject Key Identifier: 
                06:F2:F1:27:2A:76:47:4E:46:58:5A:DB:27:1B:9E:B1:9D:0A:A1:96
            1.3.6.1.4.1.34380.1.3.39: 
                ..true
            X509v3 Subject Alternative Name: 
                DNS:puppet.ppt.svc.cluster.local, DNS:openvoxserver-puppetserver-agents-to-puppet, DNS:openvoxserver-puppetserver-puppet, DNS:<http://ppt.dodges.it|ppt.dodges.it>, DNS:puppet

At least, the SAN has ppt.dodges.it, which is the correct hostname:

root@tst:/# cat /etc/puppetlabs/puppet/puppet.conf
[main]
certname = <http://tst.dodges.it|tst.dodges.it>
server = <http://ppt.dodges.it|ppt.dodges.it>
masterport = 8141
environment = production
runinterval = 1h