(#19271) Proper check for which cert to use in ssl error

Don't assume the puppet ca subject name starts with 'puppet ca'.

I think that assuming that the chain is in the correct order is better, as that how it always should be.