Currently the PKI servers make use of puppet config dns_alt name which means that they are unable to rebuild image without manual intervention.

To enable tis we need to first configure the puppetserver CA daemon to support DNS alt names. this is done by adding allow-subject-alt-names: true to /etc/puppet/puppetserver/conf.d/ca.conf, restarting puppetserver and then finally sign the cert.

We should consider enabling this setting permanently