This seems like the wrong location for this validation as it's very late in the process lifecycle and settings have already been evaluated and validated.

I recommend using a hook in defaults.rb, for example the certname setting validates it's value using this behavior: https://github.com/puppetlabs/puppet/blob/3.1.0/lib/puppet/defaults.rb#L385