http://docs.puppetlabs.com/guides/passenger.html
http://docs.puppetlabs.com/guides/scaling_multiple_masters.html
If this puppet master is not the certificate authority, you will need to use different paths to the CA certificate and CRL.
There should also be a "ca = false" and "ca_server = SOMEHOST" in puppet.conf along with other ca* values.