I think `@clientcert` might be a safer default, to match our agent certname: https://github.com/theforeman/puppet-puppet/blob/master/templates/puppet.conf.erb#L49