I think we can just tag this a breaking, for release/upgrade notes. The Puppet CA has copied the CN to a DNS alt name for quite a while now. So, the only folks caught out would be those who are running truly ancient certs, or getting their certs from an external CA that does not handle assigning DNS alt names.