puppetca

signed keys in /var/lib/puppet/ssl/ca/signed
unsigned keys in /var/lib/puppet/ssl/ca/requests

signing policy
autosign.conf

*example.com
10.0.0.0/8