gistfile1.txt

Add this to auth.conf (in my case I am setting up multiple activemq brokers.)  This will make it so that a certificate with the name broker.example.com.internal-broker can be remotely signed by the puppet agent broker.example.com and only by broker.example.com.

path ~ ^/certificate_status/([^/]+)\.internal-broker$
auth any
method destroy, save
allow $1

Use something like this in your manifest.

exec { 'broker_cert_request':
  command => "puppet certificate generate --ca-location remote --mode agent ${::clientcert}.internal-broker",      
  path    => '/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin',
  creates => "/etc/puppet/ssl/private_keys/${::clientcert}.internal-broker.pem",
}
exec { 'broker_cert_sign':
  command => "curl -S -fail -k -H \"Content-Type: text/pson\" -X PUT -d '{\"desired_state\":\"signed\"}' --cert /etc/puppet/ssl/certs/${::clientcert}.pem --key /etc/puppet/ssl/private_keys/${::clientcert}.pem --cacert /etc/puppet/ssl/certs/ca.pem https://${::puppet_ca_server}:8140/production/certificate_status/${::clientcert}.internal-broker",
   path    => '/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin',
   creates => "/etc/puppet/ssl/certs/${::clientcert}.internal-broker.pem",
   require => Exec['broker_cert_request'],
}
exec { 'broker_cert_retrieve':
  command => "curl -fail -S -k -X GET -H 'Accept: s' -o /etc/puppet/ssl/certs/${::clientcert}.internal-broker.pem https://${::puppet_ca_server}:8140/production/certificate/${::clientcert}.internal-broker",
   path    => /usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin',
   creates => "/etc/puppet/ssl/certs/${::clientcert}.internal-broker.pem",
   require => Exec['broker_cert_sign'],
}

The curls should also be doable in a Puppet face if it wasn't for a different bug, which I have already posted.