use unique certnames, config puppet agent first