Yup. There is something called the "settings catalog" that is applied during service start-up to enforce items related to

puppet.conf

. Which is why Ben Ford's question around whether they have customized CA config is relevant.