I don’t think this is correct because you should not modify /etc/puppetlabs/puppet/ssl/ca/ca_crt.pem. The correct solution is to point it at the actual CA file.
I posted the correct solution here:
The benefit of that is also that you can continue using the installer for upgrades.
