(PUP-3258) fix ENC issue with puppet apply

Rebased on stable, replaces #3118.
This is actually the same as how the ldap terminus works.