The certificate is valid, as far as the host is concerned:
# openssl s_client -connect foreman.example.org:443 0>/dev/null 2>/dev/null | sed -ne '/---BEGIN CERTIFICATE---/,/---END CERTIFICATE---/p' | openssl x509 -noout -dates
notBefore=May 5 00:00:00 2020 GMT
notAfter=May 5 23:59:59 2022 GMT
But I’m not sure what Puppet or Foreman uses to do the same.