When a Puppet server is replaced by a different one, all managed nodes must be reconfigured to cope with the new server. This won't work right away because of wrong SSL certificates. The easiest fix is to delete all SSL certificates on the nodes and let Puppet recreate them. This article lists the following steps to do so, to be executed by 'root' on both client and server:

1. On the client, delete all certificates from Puppet's SSL directory:

   find `puppet config print ssldir` -name "*.pem" -delete

2. Run the Puppet agent on the client:

   puppet agent --test

   The agent will create a new certificate and abort with a warning.
3. On the server, list and sign the new certificate:

   puppet cert list
   puppet cert sign <nodename>
   

4. Now, the Puppet agent should work again on the client.

Note: the how-to above can also be used to create a new SSL key for an agent (without changing the server) if its SSL key does not work anymore for whatever reason. In this case, the SSL key of the agent must be removed from the server in advance (i.e., before step 1 above) with the following command (to be executed on the server, of course):

puppet cert --clean <agent's certname>

Sources

• https://docs.puppetlabs.com/puppet/latest/reference/dirs_ssldir.html
• http://docs.puppetlabs.com/puppet/3/reference/subsystem_agent_master_comm.html