Come to think of it, using OS cert store to establish trust on the puppetserver side seems like A Very Bad Idea 🤔