allow nagios to check puppet's ca cert