An attempt at explaining certificate usage in Puppet and how to use an external CA like Thawte, Verisign, etc.