Among the most frustrating issues, especially for new users, are problems with the agent's SSL handshake. Such errors are especially troublesome because Puppet cannot always offer very helpful analysis in its logs—the problems occur in the SSL library functions, and the application cannot examine the circumstances.
The online documentation at Puppet Labs has a Troubleshooting section that has some advice concerning SSL-related issues as well at https://docs.puppetlabs.com/guides/troubleshooting.html.
SSL errors are reported by the agent just like other failures:
The agent opines that the CRL it receives from the master ...