root@puppet-phabricator:/home/paladox# puppet agent -tv
Info: Creating a new SSL key for puppet-phabricator.phabricator.eqiad.wmflabs
Info: Caching certificate for puppet-phabricator.phabricator.eqiad.wmflabs
Error: Could not request certificate: The certificate retrieved from the master does not match the agent's private key.
Certificate fingerprint: 4C:B3:3A:71:A1:F4:F6:F6:C7:52:1B:61:E1:F5:F4:2E:86:99:23:CF:43:72:16:B7:1E:D3:BB:EA:4E:B6:E7:78
To fix this, remove the certificate from both the master and the agent and then start a puppet run, which will automatically regenerate a certificate.
On the master:
  puppet cert clean puppet-phabricator.phabricator.eqiad.wmflabs
On the agent:
  1a. On most platforms: find /var/lib/puppet/ssl -name puppet-phabricator.phabricator.eqiad.wmflabs.pem -delete
  1b. On Windows: del "\var\lib\puppet\ssl\certs\puppet-phabricator.phabricator.eqiad.wmflabs.pem" /f
  2. puppet agent -t