playing with puppet certs