Isn't that the certname rather than FQDN, or am I confused?  [This was the bug](http://projects.theforeman.org/issues/1938) and baeb54f1 was the fix, but it was for the certname where we now trust the "clientcert" fact which is injected by the puppetmaster based on the CN of the cert (AIUI).