Out-of-the-box behavior for the Server is to read CA state from

/etc/puppetlabs/puppetserver/ca/

and trusted Public CA info from

/opt/puppetlabs/puppet/ssl/

.