Il faut récupérer le ca.pem du puppetmaster, et les certificats du puppetdb en question
sudo scp $(puppet master --configprint ssldir)/ca/ca_crt.pem puppetdb.example.com:/etc/puppetdb/ssl/ca.pem
$ sudo scp $(puppet master --configprint ssldir)/private_keys/puppetdb.example.com.pem puppetdb.example.com:/etc/puppetdb/ssl/private.pem
$ sudo scp $(puppet master --configprint ssldir)/certs/puppetdb.example.com.pem puppetdb.example.com:/etc/puppetdb/ssl/public.pem

• modifier conf pour prendre tout ça en compte :

/etc/puppetdb/conf.d/jetty.ini

The host or IP address to listen on for HTTPS connections

ssl-host = 0.0.0.0

The port to listen on for HTTPS connections

ssl-port = 8081

Private key path

ssl-key = /etc/puppetdb/ssl/private.pem

Public certificate path

ssl-cert = /etc/puppetdb/ssl/public.pem

Certificate authority path

ssl-ca-cert = /etc/puppetdb/ssl/ca.pem