Certificates with DNS alt names not handled correctly when using passenger

[gehel]

It seems that when using passenger, certificates are not generated with DNS alt names. Certificates seem to be generated in server.pp

exec { 'puppetmaster-ca-generate':
  [...]
}

but without using the --dns-alt-names option. Some trial and error modifications indicates that fixing this is not as easy as just adding the option. In at least some cases the certificate is created before the puppetmaster-ca-generate is run and so it is not re-generated.

Not really sure what the correct solution to this is...

[alvagante]

I'd follow the approach you used in gehel@2f31d7f and add a before => Service['puppet'] in the exec { 'puppetmaster-ca-generate' to be sure that it's executed before the service starts (here is when Puppet is executed and created its certs, if they don't exist).
Talking in theory, haven't check'ed such an approach.