Agents don't have signed certificates

Agent certificates must be signed by the primary server.

If the node's Puppet agent logs contain warnings about unverified peer certificates in the current SSL session, the agent's certificate signing request (CSR) that hasn't yet been signed.

1. On the primary server, run puppet cert list to generate a list of pending CSRs.
   You can also Manage CSRs in the console.
2. To sign a node's certificate, run: puppetserver ca sign <NODE_NAME>