Aye. Out-of-the-box behavior for Puppet/OpenVox is to, very pointedly, have nothing to do with

/etc/pki/

.