We discovered that the :ssl_ca:
parameter in /etc/puppetlabs/puppet/foreman.yaml
is responsible for the problem. We comment it out, and it works. Uncomment it, and it breaks:
root@foreman:~# cat /etc/puppetlabs/puppet/foreman.yaml
---
:url: "https://foreman.example.org"
#:ssl_ca: "/etc/puppetlabs/puppet/ssl/ca/ca_crt.pem"
:ssl_cert: "/etc/puppetlabs/puppet/ssl/certs/foreman.example.org.pem"
:ssl_key: "/etc/puppetlabs/puppet/ssl/private_keys/foreman.example.org.pem"
:user: ""
:password: ""
:puppetdir: "/opt/puppetlabs/server/data/puppetserver"
:puppetuser: "puppet"
:facts: true
:timeout: 60
:report_timeout: 60
:threads: null
root@foreman:~#