Hi,

We have a single puppetmaster acting as the certificate master (don't ask). Right now Foreman will try to autosign.conf whichever puppetmaster is set as the current proxy - even if it lacks the CA role.

I would like Foreman at the minimum to refuse to set build status on a machine pointing at a Puppetmaster without CA.
Better would be if Foreman could set cert master and puppetmaster seperately and do the right thing based on that.