labtest images seem to be using puppmaster fqdn instead of service url. I think in the course of T171494: Refactor OpenStack Puppet to account for Neutron this was made consistent on the master side potentially and now images in labtest do not work. This may require regenerating or fixing the master side cert too.
From an example host in prod:
[agent] server = labs-puppetmaster.wikimedia.org
From an example host using current images in labtest
[agent] server = labtestpuppetmaster2001.wikimedia.org
I believe this results in:
2017-11-28T15:26:50.954661+00:00 labtestv3-autosign-true puppet-agent[1661]: (/File[/var/lib/puppet/lib]) Could not evaluate: Could not retrieve file metadata for puppet://labtestpuppetmaster2001.wikimedia.org/plugins: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [unable to get local issuer certificate for /CN=labtestpuppetmaster2001.wikimedia.org]