this is exactly what I tried before and the puppet agent complaint that it could not find
the CA his certificate was signed with. This is a limitation in puppet.
Rob's answer worked for me around the puppet limitation. Any reason why I would not
want add the sub-ca certificate into the manage certs?
Thanks so much.