- manually generated certificate using sudo puppetserver ca generate --certname puppetdbapi.query.consul - saved certificate and private_key in eyaml