@Beam - I have also encountered this problem.
I am creating a new Puppet 6 environment and wish to migrate agents running Puppet 5.
I followed the instructions in this thread as @mooky31 has correctly identified the key steps:
1 - Replace the /etc/puppetlabs/puppet/ssl/ca.pem on the Puppet v5 agent with the contents of: /etc/puppetlabs/puppet/ssl/ca/ca_crt.pem which resides on the CA server. The ca_crt.pem contains both the root CA and the intermediate CA that were generated as part of Puppet 6 CA setup.
This will get rid of the certificate verify error and now leave an “unable to get certificate CRL” error. To fix this…
2 - Execute the following command on the Puppet v5 agent: puppet config set --section main certificate_revocation leaf.
In our scenario we will need to push these changes out using a Puppet module to several thousand Puppet v5 agents.
@mooky31 - great thread - very helpful.