The issue is that Puppetserver 6 by default generates an intermediate certificate but Puppet agents prior to 6 don’t handle that. Probably best to upgrade your agents to version 6 but if that’s not possible then https://puppet.com/docs/puppetserver/6.5/intermediate_ca.html suggests you can remove the CA setup and restart the server to generate a new CA without an intermediate cert.
