The server's TLS/SSL certificate is signed by a Certification Authority (CA) that is not well-known or trusted by the org. so we had to use Internal CA or external CA like entrust; its a security requirement from our complaince team. trying to see if anyone had faced this issue or has a workaroun with different CA other than the one comes with puppet CA.